MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18
SHA3-384 hash: b41747edbf69c0fc05b31346edfa99bcbca36babdc6288e75d7c583933c09c51370688a1f995b53d4eaece0dcc076da7
SHA1 hash: c13a7189b80da02e9b788a7a7c82add20e8b3904
MD5 hash: 888699dd46f8660a4f334539a1eb897f
humanhash: fruit-eighteen-alabama-fourteen
File name:CT-0000337_PROTECH DEL PEREU SAC.cab
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:541'091 bytes
First seen:2021-02-09 18:54:55 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:ncMzn5M/RP5JvgzOejVuayPQHDggsMGDhYBiMC3Trz:peZP7SPyPQggs30iDT
TLSH B4B42385A8D3134EFAEF67EC4B289DEB4076D612E7317D8048C38C25A523D6F25DA067
Reporter abuse_ch
Tags:cab Hostwinds SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hwsrv-830423.hostwindsdns.com
Sending IP: 104.168.219.169
From: Ericka Marquez <ap@rtisafeco.pw>
Subject: SOLICITUD DE COTIZACION
Attachment: CT-0000337_PROTECH DEL PEREU SAC.cab (contains "CT-0000337_PROTECH DEL PEREU SAC.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.537.23067.20175.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 16:37:16 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wvebqwvtlmscepmx45slj5y4jixcz4qvn4lfftzmysbmu45zh4ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab b548185ab35b24223d97e764b4f71c4a2e2cf2156f1652cf2cc482ca73b93f18

(this sample)

SnakeKeylogger

Executable exe d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f

  
Dropping
MD5 28619e1118e9490f788b48249f9a5e45
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6915fcd5141e11b64fd8b391b69be839bc3fdf4ce8d26ee4093feaa877c203f

Comments