MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d413249d5a600ea45da4d5e783557c0b264ac8dd2ca1b0c054e1154bdbae1c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d413249d5a600ea45da4d5e783557c0b264ac8dd2ca1b0c054e1154bdbae1c2
SHA3-384 hash: ff436b87e9faf987f4449770ef5af03f46bf7495e512d59a0fe9dc7fe14a6f064e303a1b1b5b9fc935f7ec903e37bb39
SHA1 hash: e84c6fc85cd53c02a4af106987062a2ae8157acb
MD5 hash: 8045e4fcef5248896db09b4b7d5e8d70
humanhash: cup-green-wisconsin-colorado
File name:1 payment invoice.7z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:427'382 bytes
First seen:2020-12-28 07:06:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:csk2U+nWcz22/g71+LnEKZcMKc+ksTyXK+Vjo4:c0Bz2z5+oKbKhiq4
TLSH 4394237DB483A8116A6E3C29C3A255970258C47BB793E7BB480B370159DAD23BFCD11E
Reporter abuse_ch
Tags:7z SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: shipping@hysong.cn
Subject: 付款发票
Attachment: 1 payment invoice.7z (contains "1 payment invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
395
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d413249d5a600ea45da4d5e783557c0b264ac8dd2ca1b0c054e1154bdbae1c2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 07:07:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rvatesovuyaouro2jvphqnkxyczgjlen2lfbwdafjyivjpn24hba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8d413249d5a600ea45da4d5e783557c0b264ac8dd2ca1b0c054e1154bdbae1c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 8d413249d5a600ea45da4d5e783557c0b264ac8dd2ca1b0c054e1154bdbae1c2

(this sample)

SnakeKeylogger

Executable exe a3d29f3885b26ef7959221cf8f1110cc9165c83a2b40ed8bd354a846fb7d3f21

  
Dropping
MD5 b1205d7d975388c82252359007460eed
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3d29f3885b26ef7959221cf8f1110cc9165c83a2b40ed8bd354a846fb7d3f21

Comments