MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ae40f7b3fff0366f2c3f857b120d68a1b406bb0c887b515dbfb4db7efde2ff1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 7
| SHA256 hash: | ae40f7b3fff0366f2c3f857b120d68a1b406bb0c887b515dbfb4db7efde2ff1e |
|---|---|
| SHA3-384 hash: | 455e23341237fee6d0ff1174bd0441a916fa1ca909823d3a4bba979b0a06d53e15547e7b05c645fb27b1f481f843bc51 |
| SHA1 hash: | b8fa95c2dec4235e921b86dfb0d444a65a04a948 |
| MD5 hash: | c8b1b42000aed9ed4658591bcb2d1360 |
| humanhash: | yankee-eight-wyoming-friend |
| File name: | 464144898 Docs.zip |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 517'850 bytes |
| First seen: | 2021-11-25 06:31:16 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 12288:ZHahkNBoZjpWbB7HNRWk3fdW4l/p7+9viHYH:0hkNBoZlK7HNRWk84/p7a7H |
| TLSH | T1D3B423B7F8223CD6315229FFB32F1934BA14CC9A3BC2A517B2FED6891EC8D195044665 |
| Reporter |  cocaman |
| Tags: | DHL SnakeKeylogger zip |
cocaman
Malicious email (T1566.001)From: "Ann-ni Low <in.ebilling@dhl.com>" (likely spoofed)
Received: "from postfix-inbound-v2-5.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "Wed, 24 Nov 2021 20:49:35 -0800"
Subject: "DHL Statement of Account - 464144898"
Attachment: "464144898 Docs.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2021-11-25 06:32:15 UTC
File Type:
Binary (Archive)
Extracted files:
68
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger spyware stealer
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.