MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c23e0b35eda6ecc111debd056c6b02d6e320b01e412c4c0575c8a4fd5e020d00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c23e0b35eda6ecc111debd056c6b02d6e320b01e412c4c0575c8a4fd5e020d00
SHA3-384 hash: 1ef407c4688c4e90221bebf798a30b49146351b11ec5773f2c5f07042d5392b9333df28249261c9917edd53c3ad2c6a9
SHA1 hash: a363b8d9b1f242715857a00348a75ab617e1390c
MD5 hash: 365e0d3f928ecbcee554f742c936e2b9
humanhash: one-one-floor-quebec
File name:Groupo Dani Order_pdf.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:388'560 bytes
First seen:2021-02-23 14:46:42 UTC
Last seen:2021-02-26 04:38:41 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:wEM0vOyPE8MxpmbMHv5kqxv2XR97TCUbvU0G/Y7Gy/xXHKi0ZUUGUsACtw:VMQO0ZMxlHv5kqxvMR9vCUrU0YYiy/x+
TLSH 6484232E347C58D0F49A52BE932B164C2530E051AFBCAC913B9DCF1BD6E09932C1B756
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?TWFyY2VsbyBDaGFtYmxhcyDigIvigIs=?=<info@finornic.com>" (likely spoofed)
Received: "from finornic.com (unknown [185.99.253.71]) "
Date: "23 Feb 2021 15:45:59 +0100"
Subject: "Groupo Dani Inquiry"
Attachment: "Groupo Dani Order_pdf.zip"

Intelligence

File Origin
# of uploads :
5
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42851.9884.2069.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c23e0b35eda6ecc111debd056c6b02d6e320b01e412c4c0575c8a4fd5e020d00/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 09:37:02 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yi7awnpnu3wmceo6xucwy2yc23rsbma6ieweyblvzcsp2xqcbuaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c23e0b35eda6ecc111debd056c6b02d6e320b01e412c4c0575c8a4fd5e020d00

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip c23e0b35eda6ecc111debd056c6b02d6e320b01e412c4c0575c8a4fd5e020d00

(this sample)

SnakeKeylogger

Executable exe 6518b199791a3c3e313cc5eaf171fafdaec34faf3d5a2da5772d576726e0aad6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6518b199791a3c3e313cc5eaf171fafdaec34faf3d5a2da5772d576726e0aad6

Comments