MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abd23d85f4783396d37cb469f17cacd9e9758676127b7a273dab5f2f1ba00bde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	abd23d85f4783396d37cb469f17cacd9e9758676127b7a273dab5f2f1ba00bde
SHA3-384 hash:	724f7d10754892dcdd15826630758dbe8aa2297a3dea1c83c17f9945585456e68d65044b6da96d25f3b5a22ee9499c72
SHA1 hash:	0df42a89bd2ba0102b80848f3acbd9ac9e4be570
MD5 hash:	c26015eae78d7d4f1cb33f73939d92bd
humanhash:	uranus-mike-hamper-mexico
File name:	SOA - S106770.pdf.z
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	781'132 bytes
First seen:	2022-10-13 07:16:34 UTC
Last seen:	2022-10-13 07:18:29 UTC
File type:	z
MIME type:	application/x-rar
ssdeep	12288:r4pDKA8QLQU6WwCzumJ0uJUh2Z9hDsep7jDlQKfZ7h2BiZ7SvciPHmiC5jOJPhgb:r4pWA8Q76WJz1J04jzF7jDlQKfZ7heWp
TLSH	T179F4337D5E8FD8AF5F70E67E9A24192321400F481E32678886528B6775FAEEDF30B444
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	payment SnakeKeylogger z

cocaman

Malicious email (T1566.001)
From: ""Managing Director"<khanpapha@sfsgl.com>" (likely spoofed)
Received: "from ilsang.biz (mail.ilsang.biz [121.179.208.103]) "
Date: "12 Oct 2022 20:27:24 -0700"
Subject: "Outstanding payment (18 July) "
Attachment: "SOA - S106770.pdf.z"

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SOA - S106770.pdf.z.exe
File size:	1'135'104 bytes
SHA256 hash:	174dc014b5ce03bf58ec6b7ce51e3245cad4ab121c6ca77a4081ec0baca127fd
MD5 hash:	44a2affae4bfe2649cfc230212b38589
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6347bb6ef2794c622d28aee0/reports/c02c29fa-1c51-4da3-8310-9b88f3cd0b56/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abd23d85f4783396d37cb469f17cacd9e9758676127b7a273dab5f2f1ba00bde/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-10-13 01:57:30 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vpjd3bpupazznu34wru7c7fm3huxlbtwcj5xujz5vnps6g5abppa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.81

Link:

https://yomi.yoroi.company/submissions/abd23d85f4783396d37cb469f17cacd9e9758676127b7a273dab5f2f1ba00bde

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.