MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94acb4fea18b06d82d1a97cb54b4780b75c4448c1d8b20abe03e00fc45d17830. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94acb4fea18b06d82d1a97cb54b4780b75c4448c1d8b20abe03e00fc45d17830
SHA3-384 hash: 1ddc8588430f23d31e55902e475394964386e7ac1a3e9c9b736df2895d4738648381d9f83ca64e784cc9383c82383f72
SHA1 hash: f781ca71320e84d251a7bebfdf4020e90cd39029
MD5 hash: 45ca759acfc92ee798c0207073202b44
humanhash: massachusetts-wisconsin-indigo-zebra
File name:URGENT TENDER675320.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:904'569 bytes
First seen:2021-02-04 09:39:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0gsQrscXXZNjX64jH9/ypNdG4ZPXTVP5bW1yvW4gMrwAmwLEg+QLKH6z+0XEC:UIRzjX64xypbGqPXT15C17MTTYlHEr
TLSH DA1533A7F1128B7539CE257024105E8E45BC7807891AC1D92C99CBEA32FEADBC7D21D3
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.fpcci.org.pk
Sending IP: 124.29.202.181
From: DANILO LARRY <cindy@medicalequipment-msl.com>
Reply-To: ''DANILO LARRY'' <cbuccioliatlgroupit@vivaldi.net>
Subject: URGENT TENDER#675320 (covid19 kits)
Attachment: URGENT TENDER675320.zip (contains "URGENT TENDER#675320.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36296768.24057.2239.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94acb4fea18b06d82d1a97cb54b4780b75c4448c1d8b20abe03e00fc45d17830/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 05:53:37 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sswlj7vbrmdnqli2s7fvjndybn24iremdwfsbk7ahyapyrorpaya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94acb4fea18b06d82d1a97cb54b4780b75c4448c1d8b20abe03e00fc45d17830

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 94acb4fea18b06d82d1a97cb54b4780b75c4448c1d8b20abe03e00fc45d17830

(this sample)

SnakeKeylogger

Executable exe b2739489880576a89cb1c779ee33cc20b37de99e7484f43262730fbf28697062

  
Dropping
MD5 5bd07883ffb3ddfae2a604760852cc19
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2739489880576a89cb1c779ee33cc20b37de99e7484f43262730fbf28697062

Comments