MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4576626781caaf4973cfccbeb124c83cb04e783d0d04dac6d1235740cc9a14a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4576626781caaf4973cfccbeb124c83cb04e783d0d04dac6d1235740cc9a14a
SHA3-384 hash: 7024be48c166b43f0848e69cb9d8c41871b63156b44fd28cb1c5545374f119206362dfbcb8c8214472bd5a255014bb59
SHA1 hash: 9ae53e589aef41145c3d095e98d461e4563753e7
MD5 hash: 4b74ca4ffe9bfde87d4949c766ac0519
humanhash: michigan-oxygen-florida-bacon
File name:Appraisal-Report.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:2'683'103 bytes
First seen:2021-02-10 18:40:34 UTC
Last seen:2021-02-10 18:41:00 UTC
File type: zip
MIME type:application/zip
ssdeep 49152:N/9irmMAWPMfibKUzCTUu/pVx6ikqYcznFSy3eapnnSOcRerFTvuTqD9aHG:PcmnQAi2oCTbBVx6iFprnqerFTvaqD9X
TLSH 58C53304EB30577FE1D706ED46C4A11882A596BB2FED3386D9B0F6E3A971E0B815C670
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: ns71venom.stableserver.net
Sending IP: 170.39.76.102
From: christene.r@appraisal-property.com <prostretch@rentablescore.com>
Reply-To: christene.r@appraisal-property.com
Subject: Fwd: Appraisal Report for your Loan Application-112310008767
Attachment: Appraisal-Report.zip (contains "Document.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4576626781caaf4973cfccbeb124c83cb04e783d0d04dac6d1235740cc9a14a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 18:41:06 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=urlwmjtydsvpjfz47tf6wesmqpfqjz4d2die3ldnci2xidgjuffa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4576626781caaf4973cfccbeb124c83cb04e783d0d04dac6d1235740cc9a14a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip a4576626781caaf4973cfccbeb124c83cb04e783d0d04dac6d1235740cc9a14a

(this sample)

SnakeKeylogger

Executable exe c126c825de9ddbbf35ebcd0f63205c80f769e55d95d27e1dadda8b5c9d245569

  
Dropping
MD5 340f6a0f13f46a9358ff729ef7c97b8f
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c126c825de9ddbbf35ebcd0f63205c80f769e55d95d27e1dadda8b5c9d245569
  
Dropping
SHA256 5e830a2d4d6657b51c64675521e224dab8ba81916e2409053f549f045a85b4d2
  
Dropping
MD5 f20765e98957db2e9bd4e8e69f239944

Comments