MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9643a96eab00e36b8e9632697690dee7002914f1738feff766eb4a3719b57e51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9643a96eab00e36b8e9632697690dee7002914f1738feff766eb4a3719b57e51
SHA3-384 hash: 865f70107bdd8040bffed6d4d4d71c213db2f4fc3195c550d8fd583884d274ee6fd0eae01478304f07fe9a6a2bc062cd
SHA1 hash: 784a4445b539f3131a04eb52dfb82b928c1303ef
MD5 hash: d58547ed48d4a6c25822b3a35b85980f
humanhash: delaware-nineteen-cola-kitten
File name:Su ltima factura de DHL CMBR000563391.r00
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:276'594 bytes
First seen:2021-01-11 18:42:29 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:pXs3c1z9zIQg9nIdjEmZz8oWjds1scPayhaShv9oFvi/bIYmx4E6BipEi:lh1z90Qgyd4m18vs1NhHoFqkD6o2i
TLSH 2B4412D1108CD4C56A9A139281828EE3EFC3DAE0A6D48777F3A8A691F019DF81715FD7
Reporter abuse_ch
Tags:DHL ESP geo r00 SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.webmin-serv.com
Sending IP: 37.221.115.23
From: DHL <query.lk@dhl.com>
Subject: DHL EXPRESS
Attachment: Su ltima factura de DHL CMBR000563391.r00 (contains "Su última factura de DHL CMBR000563391.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9643a96eab00e36b8e9632697690dee7002914f1738feff766eb4a3719b57e51/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 18:43:08 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=szb2s3vladrwxduwgjuxneg644acsfhrooh6753g5nfdognvpziq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9643a96eab00e36b8e9632697690dee7002914f1738feff766eb4a3719b57e51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r00 9643a96eab00e36b8e9632697690dee7002914f1738feff766eb4a3719b57e51

(this sample)

SnakeKeylogger

Executable exe b246071c05dec2f4838b27fd6c11548e90f7deaaeb658530864d10efdb129c37

  
Dropping
MD5 e7b9c897689ada9d3107daba129a6cfc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b246071c05dec2f4838b27fd6c11548e90f7deaaeb658530864d10efdb129c37

Comments