MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 952845193ccee27cc056375e26e4c4f5f83de6f771a4d7b8359e14337e8885b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 952845193ccee27cc056375e26e4c4f5f83de6f771a4d7b8359e14337e8885b7
SHA3-384 hash: af492f5c6aab9d4f2a8be97ab2bcbe193530e61f05bd80037820efb6f8f5b6e656ef4fbfbbaa40bb6c0f6bb8bf89507d
SHA1 hash: 35d7302fb77cdfe3d0e819be83185ad0d6650ac3
MD5 hash: 47cec59b923e013608c614ced37ba1e0
humanhash: mississippi-aspen-jupiter-fix
File name:DHL_FORM_000198253367_PDF.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:651'229 bytes
First seen:2021-02-15 06:50:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:HdGWmZDDAf+Sf7fKkTXAPOtGYq4OlrABzg7S1E8z71/ok96O7LR6kCRhmtcBI:9GW0Xi5DNTi7hXZABz71Es7b96QsX3S
TLSH D0D4239F8242E95852DE3C7A20D0C87E7FC918A59880CCA70BBE19C4576271DB8D59FF
Reporter abuse_ch
Tags:DHL rar SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.rodell.ro
Sending IP: 89.33.126.138
From: DHL EXPRESS (ES) <dhlSender@dhl.com>
Reply-To: result.box2019@mail.com
Subject: ENTREGA DE DHL (NOTIFICACIÓN DE FALLO)
Attachment: DHL_FORM_000198253367_PDF.rar (contains "DHL_FORM_000198253367_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/952845193ccee27cc056375e26e4c4f5f83de6f771a4d7b8359e14337e8885b7/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-15 06:50:12 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=suuekgj4z3rhzqcwg5pcnzge6x4d3zxxogsnpobvtykdg7uiqw3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/952845193ccee27cc056375e26e4c4f5f83de6f771a4d7b8359e14337e8885b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 952845193ccee27cc056375e26e4c4f5f83de6f771a4d7b8359e14337e8885b7

(this sample)

SnakeKeylogger

Executable exe 32f1de5afc9dcd3a7f12a950219cd9e838445681f4089bff7a8f3b2ed05363f5

  
Dropping
MD5 fbecc83537cf14bcd64530e8c00a8315
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32f1de5afc9dcd3a7f12a950219cd9e838445681f4089bff7a8f3b2ed05363f5

Comments