MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acefb52edb007ceb66b5913d70efd0512adf1d162d192f4f3e353d24864bedb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acefb52edb007ceb66b5913d70efd0512adf1d162d192f4f3e353d24864bedb3
SHA3-384 hash: 854120252780a72045dd140b503d104809b974f1eb2bcce2c88ff9f3bc90f6c8ec75884ae5e06fe5ebf8945ad9d07e12
SHA1 hash: 4557dc1889c66cf4693f161e35ec06790eab3016
MD5 hash: c4f91cedecf3015b0eef72cc42d69f7a
humanhash: mountain-idaho-oxygen-maine
File name:purchase order.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:613'066 bytes
First seen:2021-03-09 11:55:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:kcUd5f2pZI5C8P6SYei/kQ9YHyxY476HmnoWbLpBOgxuH627/:d4+Og8Pj7i/kQiHyLRbs1/
TLSH C0D433A87B1D2D7969C41036DE5A07602E10F0F276FBDF916B218E1E1F9A0438BFB525
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cl-t002-054cl.privatedns.com
Sending IP: 64.15.155.21
From: smtp-3ywvc@australiastartups.org
Subject: PO.
Attachment: purchase order.gz (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.17378.11585.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 11:56:11 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtx3klw3ab6owzvvse6xb36qkevn6hiwfums6tz6gu6sjbsl5wzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/acefb52edb007ceb66b5913d70efd0512adf1d162d192f4f3e353d24864bedb3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz acefb52edb007ceb66b5913d70efd0512adf1d162d192f4f3e353d24864bedb3

(this sample)

SnakeKeylogger

Executable exe f60ed556e32e0540dd3d1148e9e888ade66ca0a0e4104d5b6c17cda4f0719941

  
Dropping
MD5 c5a3961c015dca45ebac37ac09ae63a2
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f60ed556e32e0540dd3d1148e9e888ade66ca0a0e4104d5b6c17cda4f0719941

Comments