MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2f8a2e65974fc7b49d0ddb6108407ba7429906064b4cf3ddc91ce862a73f407. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2f8a2e65974fc7b49d0ddb6108407ba7429906064b4cf3ddc91ce862a73f407
SHA3-384 hash: ad8191a9ee413a53392e87202f344ccbb3c9412636e2391dac8025496261d7413ee4c14f3024e5b94762d017bd504701
SHA1 hash: a7f6c10c1f103951a25effe73491e597bd3980b3
MD5 hash: 8f2cac3a9998a2383a99d5af0fb7ef42
humanhash: one-tennessee-mobile-pip
File name:ekstreniz.z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'086'640 bytes
First seen:2020-12-22 07:08:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:T8MjOFooc9OAO7s8uyuXX0MSwGKE6iI/YVSLwtDeS0zWRK/ToQs8wZlwJmR:T7SeOb7sGuXXTiI/QFrKoK/ToR8/JmR
TLSH A53533360E48C191B3D8335EEE8A72223F523269D857E9423F2B9765E7DCD84E28581D
Reporter abuse_ch
Tags:geo TUR z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: ekstre@eekstre.qnbfinansbank.com
Subject: CardFinans KOBİ Visa Aralık ayi ekstreniz.
Attachment: ekstreniz.z (contains "ekstreniz.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.482.4406.1770.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2f8a2e65974fc7b49d0ddb6108407ba7429906064b4cf3ddc91ce862a73f407/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 07:09:04 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wl4kfzszot6hwsoq3w3bbbahxj2ctedams2m6po4shhimktt6qdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2f8a2e65974fc7b49d0ddb6108407ba7429906064b4cf3ddc91ce862a73f407

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip b2f8a2e65974fc7b49d0ddb6108407ba7429906064b4cf3ddc91ce862a73f407

(this sample)

SnakeKeylogger

Executable exe 01215ac46a00f3c840e0a69a7864241e60e2878f8c8f3c7ad213d44bd140c883

  
Dropping
MD5 2a2ede233e034ed24c4e441b185dcd78
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01215ac46a00f3c840e0a69a7864241e60e2878f8c8f3c7ad213d44bd140c883

Comments