MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c9b1356d4da85307afb9ddef36829fb09d4747455f1a14145fe05682db40c49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c9b1356d4da85307afb9ddef36829fb09d4747455f1a14145fe05682db40c49
SHA3-384 hash: cdc4c7819e6a68330101d2fa820bc337601227774b7a57adc328b8062634e61fdcb1e63ddc307c03126a1d6413e2ed70
SHA1 hash: ad09cc657ce92139d2e47bb442e4ab29d6705377
MD5 hash: 5e1f305fe98463cc5c4bdd8aec501279
humanhash: wolfram-minnesota-network-artist
File name:payment status.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:307'291 bytes
First seen:2021-01-31 07:41:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/Im9217OM6SwmVPxSYl+dGsz2024VVFq0Nki1OqsKlecsyfaq:/ImGRw0JSYlpbxGNxlsa
TLSH F56423195692F036E5B9BF0393B8DAB955640AE27F40CA8D3DC9BB02C9C67C84D5CEC1
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: air.nseasy.com
Sending IP: 64.37.52.73
From: Matiul Islam <islam@fmakers.com>
Subject: RE: REMINDER-3- Pearl Fashion - 55359479-payment status -tuv India pvt ltd-Rs-44,250/-
Attachment: payment status.zip (contains "payment status.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c9b1356d4da85307afb9ddef36829fb09d4747455f1a14145fe05682db40c49/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-30 11:39:19 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsnrgvwu3kcta6x3txppg2bj7me5i5dukxy2cqkf7ycwqlnubreq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c9b1356d4da85307afb9ddef36829fb09d4747455f1a14145fe05682db40c49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 9c9b1356d4da85307afb9ddef36829fb09d4747455f1a14145fe05682db40c49

(this sample)

SnakeKeylogger

Executable exe 71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45

  
Dropping
MD5 f0b5aa17657d3f28219d4c4bf6d4e20d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45

Comments