MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b
SHA3-384 hash: 54e1b0ae07a3a33fece4d638f530d407e81d16bab9691cdafd5beaf20fc47a14219acbbeafdaf8dccb2e1601fce52b52
SHA1 hash: a31c7dee3d43b4c2fa103999d6ad4c5fca2caf73
MD5 hash: db671e1ec4f71b051a4efe0cac7d09c1
humanhash: nitrogen-early-emma-nitrogen
File name:QUOTATION URGENT PRODUCTION NEEDED FOR DINTEC ORDER LIST Ref 37470 RFQ PIP001 _scanned from e xerox multifunctional device007_pdp.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'507'328 bytes
First seen:2021-08-12 05:39:34 UTC
Last seen:2021-08-12 05:52:27 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:/kJtPdGVDaHK7zTe++KINAeU+dy7fOhL8sCTqegHCcxvKIHWBSGm:cJYO+VluZL8sCTyHlZdH2S
TLSH T14F65BF2E76C04BD4F2720E3DECDDB01076B9BC015A43DE2FAC987629552F6958A3219F
Reporter cocaman
Tags:img SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "Shirley Lee <service@dintec.co.kr>" (likely spoofed)
Received: "from dintec.co.kr (unknown [203.159.80.132]) "
Date: "11 Aug 2021 16:46:48 +0200"
Subject: "QUOTATION URGENT PRODUCTION NEEDED FOR DINTEC ORDER LIST (Ref: 37470/RFQ/PIP/001)"
Attachment: "QUOTATION URGENT PRODUCTION NEEDED FOR DINTEC ORDER LIST Ref 37470 RFQ PIP001 _scanned from e xerox multifunctional device007_pdp.img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.993-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 17:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r7ayvho7yrdzrvsddbfrmxvzagnnfegt3r7icfrmt2dhlg4okknq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img 8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b

(this sample)

SnakeKeylogger

Executable exe 0a101b8b739c481e387e2daf5d85aaa93cf0188ff798233817e2e349b7ac1fe9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a101b8b739c481e387e2daf5d85aaa93cf0188ff798233817e2e349b7ac1fe9

Comments