MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a23124da817f4836a34dbcf126a61ab40d76c5fe078806ffefd623bec8d6c535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a23124da817f4836a34dbcf126a61ab40d76c5fe078806ffefd623bec8d6c535
SHA3-384 hash: f89727512c256bf59ec4037df4472a34d3c1d3202edeef9ca1f2607cd8b025868e40409fdbcaa087bf61c47fd086d3ba
SHA1 hash: 4d672b0ac80972cabdfb582606099a4b8d9678fd
MD5 hash: 166992740b15f238ae5cc3573a18becb
humanhash: victor-mississippi-early-florida
File name:Purchase Order#2021.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:609'726 bytes
First seen:2021-02-08 11:41:31 UTC
Last seen:2021-02-08 15:58:34 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:aZHLgjw3e7BCu9GWBlRglm7dN3b5s/7dI0vRJ4JQ6nxVNNIAFI9inXUl4yOHf9y:QHsYucu9VglGdN3qTPexVvK97l4yZ
TLSH B6D4236F75F5CD007934BE983CDCA7D4CA6721BB5A82F8023425EC9BE159B84FAC0509
Reporter lowmal3
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a23124da817f4836a34dbcf126a61ab40d76c5fe078806ffefd623bec8d6c535/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 11:42:09 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uiysjwubp5edni2nxtysnjq2wqgxnrp6a6ean77p2yr35sgwyu2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/a23124da817f4836a34dbcf126a61ab40d76c5fe078806ffefd623bec8d6c535

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip a23124da817f4836a34dbcf126a61ab40d76c5fe078806ffefd623bec8d6c535

(this sample)

SnakeKeylogger

Executable exe 02673393853e5084906a0aaf7f396fd8627f56f75433c4c59368d45ded24e12f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 02673393853e5084906a0aaf7f396fd8627f56f75433c4c59368d45ded24e12f
  
Dropping
MD5 439b9ad435555141f915dd83fe2b84b5

Comments