MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f14cb8750c311acc503061d5bc90490581b2b42cd5f0d23678ef8fc930c3246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f14cb8750c311acc503061d5bc90490581b2b42cd5f0d23678ef8fc930c3246
SHA3-384 hash: 801191d2bf563c1223f9a5a8a99e61d500d22ff9327ef65a93940b83931144148005963de7d8c19744ca4885980d5d92
SHA1 hash: 0ceb222c2a3b8ebf49951f04dbc3cdd5d84e5faf
MD5 hash: 297479f2dc7414aa7e173b1413c17555
humanhash: utah-tennessee-music-apart
File name:1708 210225SEBDBDDHABAN9012598115.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:912'710 bytes
First seen:2021-03-01 06:47:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:7ZGSbYsHcxVbdPOYU85FFdlreJ3ZsqUctuV5kDr:40HHcxVbdG8ddGZsOtuPs
TLSH BB1533CC974121326E2789FCD25A7D70AF9502D256D30CFA840D57B2FBE6A31E79E068
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: gmail.com
Sending IP: 45.85.90.187
From: ERSHAD <ershad@irisgroupbd.com>
Subject: Re: L/C COPY
Attachment: 1708 210225SEBDBDDHABAN9012598115.zip (contains "1708 210225SEBDBDDHABAN9012598115.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.7930.1837.22130.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f14cb8750c311acc503061d5bc90490581b2b42cd5f0d23678ef8fc930c3246/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-01 06:48:13 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4kmxb2qymi2zridayovxsiesbmbwk2czvpq2i3hr34pzeymgjda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/9f14cb8750c311acc503061d5bc90490581b2b42cd5f0d23678ef8fc930c3246

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip 9f14cb8750c311acc503061d5bc90490581b2b42cd5f0d23678ef8fc930c3246

(this sample)

SnakeKeylogger

Executable exe b163be32f8e28a0eac6116574a64ea6440a99daf9a4e08c2062b6ecb9ac1aaf6

  
Dropping
MD5 75491c04f63a841f073499d2b1cf4ff3
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b163be32f8e28a0eac6116574a64ea6440a99daf9a4e08c2062b6ecb9ac1aaf6

Comments