MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 beba1b53cc5aed5341b78c6011cf16136218faa25d0a5ae6b9e2e3ce952f0d78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 5
| SHA256 hash: | beba1b53cc5aed5341b78c6011cf16136218faa25d0a5ae6b9e2e3ce952f0d78 |
|---|---|
| SHA3-384 hash: | 1e3d852b7b898d1f5a9171e62558c850b80c62a7bfb621fc26f4232f926b4f449bb98e4181e100ad1a504346273ade71 |
| SHA1 hash: | 1f80881a755bd14742d3572c488c87f5b421f451 |
| MD5 hash: | bf5debdb19350b5beb73576e30398a55 |
| humanhash: | indigo-september-sixteen-river |
| File name: | STATIONERY MATERIALS-ORDER SUPPLEMENT.r00 |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 444'566 bytes |
| First seen: | 2021-07-27 11:18:09 UTC |
| Last seen: | Never |
| File type: | r00 |
| MIME type: | application/x-rar |
| ssdeep | 12288:WYr22WeNo04PDFlSxIbDhFIX+S1cHdZph95h/4:tr22RoDFlSq/hFIB1c9P5N4 |
| TLSH | T1519423D26276BAF2E5DC507D8A2043DA69DC7FD6B056083BAE90E4E05E502D32F431F6 |
| Reporter |  cocaman |
| Tags: | r00 SnakeKeylogger |
cocaman
Malicious email (T1566.001)From: "Salih Kaya <salihkaya@armetal.org>" (likely spoofed)
Received: "from armetal.org (unknown [45.137.22.71]) "
Date: "27 Jul 2021 08:29:41 +0200"
Subject: "Re; (STATIONARY ORDER)"
Attachment: "STATIONERY MATERIALS-ORDER SUPPLEMENT.r00"
Intelligence
File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-07-27 01:37:14 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
14 of 28 (50.00%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
SnakeKeylogger
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.