MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2c961da91aa387b7bde996331d19b91471233c3d842dcbe3219efdfca70e112. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2c961da91aa387b7bde996331d19b91471233c3d842dcbe3219efdfca70e112
SHA3-384 hash: 91971d7711f737be5c794b7fef8ca84d492bc3caf56695b5428fd41f949d3feafe581ff3bde0e52daeb1cf557a6b9ef1
SHA1 hash: 0e80d99d103dbfc25a98f3dcd799603816e7396f
MD5 hash: 8338f16af718636284e8ac1f219f0de3
humanhash: oscar-quebec-high-gee
File name:CT-0000337_PROTECH DEL PEREU SAC.cab
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:651'777 bytes
First seen:2021-02-05 18:41:40 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:xkxe/eYkarVizN/7NV/UD0mbkbi4QdmTwMEiDXwbCtYO1IHsW:xuY9rVyNDDsDDkbihmTwme42
TLSH F2D4233E5F13F47210562F8A92BA0ED04DF810FD5F6786D9D539E62109EEAB22781DE0
Reporter abuse_ch
Tags:cab Hostwinds SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hwsrv-831733.hostwindsdns.com
Sending IP: 104.168.203.143
From: Ericka Marquez <pvr@gardenwoaltd.pw>
Reply-To: ap@rtisafeco.pw
Subject: SOLICITUD DE COTIZACION
Attachment: CT-0000337_PROTECH DEL PEREU SAC.cab (contains "CT-0000337_PROTECH DEL PEREU SAC.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.ZODtr.25966.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2c961da91aa387b7bde996331d19b91471233c3d842dcbe3219efdfca70e112/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-05 18:42:08 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulewdwurvi4hw666tfrtdum3sfdrem6d3bbnzprsdhx57stq4eja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a2c961da91aa387b7bde996331d19b91471233c3d842dcbe3219efdfca70e112

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab a2c961da91aa387b7bde996331d19b91471233c3d842dcbe3219efdfca70e112

(this sample)

SnakeKeylogger

Executable exe 47a5d8f12a7f88e97420e20809ae248ad42eaffda90df839d921caed39796f45

  
Dropping
MD5 764e2f15b22b1ea8c24923738270343d
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47a5d8f12a7f88e97420e20809ae248ad42eaffda90df839d921caed39796f45

Comments