MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8cbed164ea439d5fea8324de4c0bace2cffd671d845bf301730ab99b57afb81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	a8cbed164ea439d5fea8324de4c0bace2cffd671d845bf301730ab99b57afb81
SHA3-384 hash:	327b9b625e218d4856303e3572324df83068b5235dbadea65ef8064c08d9660ed731f9cedd0a92df56b61fef0479d7f7
SHA1 hash:	457221e5c56a3e23db645c0158cd59e1e8cc9937
MD5 hash:	64f7032c5d17b6757bc1e3b688c10209
humanhash:	north-lima-iowa-nuts
File name:	SC_TR116709004.ace
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	768'930 bytes
First seen:	2024-08-14 17:11:43 UTC
Last seen:	Never
File type:	ace
MIME type:	application/octet-stream
ssdeep	12288:hZmlJzEhl413zvuPMSpyuR8LNf2G3FlxTBWbKifdCqth4BwHUHsMtxZPdkcFb2JQ:7mnoA1zvu0Sp9RqYG3xTQCuhYcUHpZPn
TLSH	T1C2F4332AFD30751AAD81C05F6AF0E7C56BE65F8C3E192705BB3198DA564D806C80DBA1
Reporter	cocaman
Tags:	ace SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "Standard Chartered Bank <remi@filevitals.com>" (likely spoofed)
Received: "from forth.filevitals.com (forth.filevitals.com [193.25.216.237]) "
Date: "Tue, 13 Aug 2024 00:50:07 -0700"
Subject: "Advice from Standard Chartered Bank"
Attachment: "SC_TR116709004.ace"

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66bce564b35234d5cc65e2c8

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/66bce5643930e113b90b4e31/reports/08db609f-b8b5-4433-bea7-5bc35101b544/overview

Verdict:

Malicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/a8cbed164ea439d5fea8324de4c0bace2cffd671d845bf301730ab99b57afb81

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8cbed164ea439d5fea8324de4c0bace2cffd671d845bf301730ab99b57afb81/

Threat name:

ByteCode-MSIL.Infostealer.Pony

Status:

Malicious

First seen:

2024-08-13 05:05:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vdf62fsouq45l7vigjg6jqf2zywp7vtr3bc36maxgcvztnl27oaq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a8cbed164ea439d5fea8324de4c0bace2cffd671d845bf301730ab99b57afb81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ACE_Containing_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc
Description:	Looks for ACE Archives containing an exe/scr file