MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd65db42d9215064c539109f823daef013e66299ae60584cbf658ffa3fc686d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd65db42d9215064c539109f823daef013e66299ae60584cbf658ffa3fc686d1
SHA3-384 hash: b916075f3bd582f24def96f8e546333599e001d16e8bc622365cc5a7eb16ac7756704b56d5ab68ffb0e57adaed3fdbcf
SHA1 hash: 7d23900ebf86d12e8e7ca5f33a9006a2ea5cc245
MD5 hash: 0d2f49ec43f53846bfe410b42901bedf
humanhash: mississippi-montana-steak-alabama
File name:New order.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:515'335 bytes
First seen:2021-05-14 10:52:37 UTC
Last seen:2021-05-14 11:03:36 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:/pcu1ZHkJShNYZkXRkwW8U9rKQG+ii/QaHmW:x91ZEATYkXtpW+n+iCQaGW
TLSH 2DB423F645B81B9DA46C0E3B6A75A1F70375C9086DAB7BF34921F58B22460332B31C9D
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Rohit Halwai <rohit.halwai@witmansgroup.com>" (likely spoofed)
Received: "from mail.globeedit.com (mail.globeedit.com [195.201.227.111]) "
Date: "Fri, 14 May 2021 07:26:49 +0100"
Subject: "New order PO#1088063401"
Attachment: "New order.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/bd65db42d9215064c539109f823daef013e66299ae60584cbf658ffa3fc686d1
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd65db42d9215064c539109f823daef013e66299ae60584cbf658ffa3fc686d1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-14 10:53:04 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvs5wqwzefigjrjzccpyepno6aj6myuzvzqfqtf7mwh7up6gq3iq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210514-efxad2kwd2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip bd65db42d9215064c539109f823daef013e66299ae60584cbf658ffa3fc686d1

(this sample)

SnakeKeylogger

Executable exe edcc4c2888b2efd98c5bbcc069e24a2762203029bc22a314596534482c262132

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 edcc4c2888b2efd98c5bbcc069e24a2762203029bc22a314596534482c262132

Comments