MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98
SHA3-384 hash: b0db04bb2e77b53b6d282b34b09fdcffc7c97cdcbd82fcad121fff440129e6bd4a60cb8cc48077de06bd7d013f7f0f34
SHA1 hash: b292fe0ede14abc8e032d3cc75bee2e74770e175
MD5 hash: 3a151754c2dabd64d43dadec97a51dc1
humanhash: artist-pennsylvania-quiet-april
File name:ZYJY-2021010007.DBLF0445+446+441 美阳+纳翔辉+众源 2柜.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:608'001 bytes
First seen:2021-08-06 06:31:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Ti5ePHoAjmCnRrBYa5n3U8iAuhNXeRe9deLA6IkX8sZtY0d:TBPxiC04nk8iAUORe9YU6FZvd
TLSH T114D43339CA9FC1A582C8AC874C1897FD6F635994BE1D17599E377A30EF6A4E030044EE
Reporter cocaman
Tags:lzh rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "June.Wang(Ms. June Wang) <hkwxy@hmm21.com>" (likely spoofed)
Received: "from hmm21.com (unknown [185.222.58.146]) "
Date: "6 Aug 2021 07:35:27 +0200"
Subject: "=?UTF-8?B?5a+56LSm5Y2VLeS8l+a6kC0=?="
Attachment: "ZYJY-2021010007.DBLF0445+446+441 美阳+纳翔辉+众源 2柜.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-06 05:59:44 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xsr63xgty7a7cnkctbii3q3ehnglf5rorpg3w3hypnubjro3p2ma._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210806-seqxfkh7ds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar bca3eddcd3c7c1f1354298508dc3643b4cb2f62e8bcdbb6cf87b6814c5db7e98

(this sample)

SnakeKeylogger

Executable exe b96e2add8b9a663566f740d06f882ee0147aab444bb026c9d1ce6998927f3d53

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b96e2add8b9a663566f740d06f882ee0147aab444bb026c9d1ce6998927f3d53

Comments