MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2445538599cc4a35753e041c44e3701a226fa6882c54f20b610a486dd87a399. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2445538599cc4a35753e041c44e3701a226fa6882c54f20b610a486dd87a399
SHA3-384 hash: fe6d87e12db7b69ee87f835793baaa4b2157a68b469e4ff2f3b16805124be62eb00629ed387c306ba21e6d1bb44d4308
SHA1 hash: 2d8e040c2f93bc34235f1e3770db5be05889ffd5
MD5 hash: 044d3383593880763a35e0062770b1ab
humanhash: cold-bluebird-emma-two
File name:PaymentCopy.cab
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:702'705 bytes
First seen:2021-02-24 11:56:30 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:lB21FSkWL3EfYC6uV2Tq7IKCca4TokZdZubvLiXuUgpoMRs7sIqQ6a:nkWzEd6dTEI1PkZ2bvLUuUgpoMC7SI
TLSH 4DE4331F848B277F26E983A64414D15839F55A8688F237FC05EC29BAFABC1C3390E55D
Reporter abuse_ch
Tags:cab SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: df0.328.xvonq.ml
Sending IP: 165.232.128.251
From: Laura <anjali@insightwithin.com>
Subject: RE: Payment
Attachment: PaymentCopy.cab (contains "PaymentSwift.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodCab-A.32502.922.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2445538599cc4a35753e041c44e3701a226fa6882c54f20b610a486dd87a399/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 09:42:34 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ujcfkoczttckgv2t4ba4itrxagrcn6tiqlcu6ifwccsinxmhuomq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab a2445538599cc4a35753e041c44e3701a226fa6882c54f20b610a486dd87a399

(this sample)

SnakeKeylogger

Executable exe 61421dae61a8c104b25cb3a59ccb1f07e783e4def536575e444d0c74291e63ce

  
Dropping
MD5 bc20bcef2799a1047c166d10dfa07dd5
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61421dae61a8c104b25cb3a59ccb1f07e783e4def536575e444d0c74291e63ce

Comments