MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6be3ffa848a74cc7414802e9482a6a214b733c61c7304d8f789f88aca755e30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments

SHA256 hash:	b6be3ffa848a74cc7414802e9482a6a214b733c61c7304d8f789f88aca755e30
SHA3-384 hash:	79cbdb13b1c3a6e2a0d4f9cc77521bb20a9a540942fe85d1c69f10a0a8b798cc437c085c1bf9a2bf33381458cab75364
SHA1 hash:	cc133a196ccc1b1b9eef00496598f11a51a6a68f
MD5 hash:	1dfd9cd680c5410d552d4d8255be311a
humanhash:	lithium-tennis-uncle-texas
File name:	餘額支付.pdf.z
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	402'760 bytes
First seen:	2022-11-02 08:56:14 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:X+zYDAFpAhE3asZ5/hUs0LW6rWwMXwMFEjLQ+OVHiSWqW:mYIcE3aMxetRWwMXwMFkEMXqW
TLSH	T19484226D3F74CC2042FBAD3EF1A924A2567255C307CA2A24909C8D33DCDAD35DC4AB29
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	payment SnakeKeylogger z

cocaman

Malicious email (T1566.001)
From: "Emma Brayne Credit Controller <sie.ran@internetkoala.com>" (likely spoofed)
Received: "from raifjvws.internetkoala.com (raifjvws.internetkoala.com [85.217.145.178]) "
Date: "Wed, 02 Nov 2022 04:02:35 +0100"
Subject: "=?UTF-8?Q?=E7=A2=BA=E8=AA=8D=E9=A4=98=E9=A1=8D=E6=94=AF=E4=BB=98?= =?UTF-8?Q?=E7=9A=84=E6=AD=A3=E7=A2=BA=E9=8A=80=E8=A1=8C=E8=A9=B3=E7=B4=B0?= =?UTF-8?Q?=E4=BF=A1=E6=81=AF=20=28Confirm=20Correct=20Bank=20Details=20Fo?= =?UTF-8?Q?r=20Balance=20Payment=29?="
Attachment: "餘額支付.pdf.z"

Intelligence

File Origin

# of uploads :

# of downloads :

163

Origin country :

n/a

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	32512
File size:	20 bytes
SHA256 hash:	d7982947de131b347ddbab9cf93974f7e52d55b2336e9b9747ff015a4b762fe6
MD5 hash:	f5debe591ba2cb0a6325230258f5bffd
MIME type:	application/octet-stream
Signature	SnakeKeylogger

File name:	餘額支付.pdf.exe
File size:	443'904 bytes
SHA256 hash:	47ddfd857cfbfde58f7599c330823dd214cb0b7f1f10c3762ecc617e06c1be1a
MD5 hash:	c8b9f9324157d0f9e62b2887c5ab4f09
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/636230de58409ff7bc0c8623/reports/b780bf6c-1a81-4b4d-876a-91961a757433/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b6be3ffa848a74cc7414802e9482a6a214b733c61c7304d8f789f88aca755e30/

Threat name:

Win32.Trojan.Tisifi

Status:

Malicious

First seen:

2022-11-02 03:24:19 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

21 of 41 (51.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w27d76uerj2my5auqaxjjavguiklom6gdrzqjwhxrh4ivstvlyya._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/b6be3ffa848a74cc7414802e9482a6a214b733c61c7304d8f789f88aca755e30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research