MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9db30166127dd97862c8483553a059c0e29fa53b50ac17926b1eef55b63aa24f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9db30166127dd97862c8483553a059c0e29fa53b50ac17926b1eef55b63aa24f
SHA3-384 hash: f5fefd0e735ad82477e0efc2597243afcd950147383c72d6f91e8c58b35a55b7d8920610e00f182938fc6c98bb7272c1
SHA1 hash: 7fc0bdc13c6dc3f9a6faeb11a2223b94f2c7fa6a
MD5 hash: d702b465244361115b6974367ccf702d
humanhash: may-rugby-nevada-pennsylvania
File name:Updated SOA8203204927107.pdf.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'137'410 bytes
First seen:2021-02-16 13:21:52 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:Sc+EINin0zh1YT3q+iSoSHYB15+CMdtnn0bLFbT7fL1SLaTUdKV:SRhon0zva3Wh1UL0bLpT7fuKV
TLSH 2A3533024B67D698BE7114F21A86A3804895371EF9FC84B60BF7B84179435AE07E8F7D
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.107
From: Binoy M R <info@supertorque.ae>
Subject: Updated SOA
Attachment: Updated SOA8203204927107.pdf.gz (contains "Updated SOA8203204927107.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.27448.10867.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9db30166127dd97862c8483553a059c0e29fa53b50ac17926b1eef55b63aa24f/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 13:22:09 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twzqczqspxmxqywija2vhiczydrj7jj3kcwbpetld3xvlnr2ujhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9db30166127dd97862c8483553a059c0e29fa53b50ac17926b1eef55b63aa24f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz 9db30166127dd97862c8483553a059c0e29fa53b50ac17926b1eef55b63aa24f

(this sample)

SnakeKeylogger

Executable exe 89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829

  
Dropping
MD5 6f8faaa0b38d96d6a22e77ef6bb92c5e
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89f1983ad923c2485a4b4e06b168a096546d35fd90e88d26485756a37fc4a829

Comments