MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c60253d343fd7a1d6aceca5668eb36cc3d13484b90089c36f094e82b29042a5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c60253d343fd7a1d6aceca5668eb36cc3d13484b90089c36f094e82b29042a5b
SHA3-384 hash: fa6430fa884ba7cc364f6a94845ceb6714a95086d315a02823bfbb2266d4b2f5b37e5da1edd5a8e3ad881a5598ae6fa2
SHA1 hash: 10d8629e49ed94ce52950b646f27f359d7551689
MD5 hash: 845e1788dd8cf665becbe0fe857760c6
humanhash: nitrogen-failed-carbon-xray
File name:SWIFT-MT103.r15
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:479'132 bytes
First seen:2021-02-10 07:06:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:jieNMKFs0EK0cWzYLKUhPMrobJO5TQTxFyXl:jdMqZ0cWcL5woogFy1
TLSH 48A4231EC527EB97286474DD71B73A486FAA8ACDF89060778BA33C89E59433070F9453
Reporter abuse_ch
Tags:r15 SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: mail.fpcci.org.pk
Sending IP: 124.29.202.181
From: Accounts Dept <accounting@korman.com.tr>
Subject: FW: TT COPY
Attachment: SWIFT-MT103.r15 (contains "SWIFT-MT103.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c60253d343fd7a1d6aceca5668eb36cc3d13484b90089c36f094e82b29042a5b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 07:07:07 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yybfhu2d7v5b22wozjlgr2zwzq6rgsclsaejynxqstucwkiefjnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c60253d343fd7a1d6aceca5668eb36cc3d13484b90089c36f094e82b29042a5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar c60253d343fd7a1d6aceca5668eb36cc3d13484b90089c36f094e82b29042a5b

(this sample)

SnakeKeylogger

Executable exe 4453fb0ba07fc3cc2d7a6e561b1443ed20f722248b8a8a4e0faafe66031988ea

  
Dropping
MD5 23e7cb8ce35e5ff5f2e74307deaa046e
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4453fb0ba07fc3cc2d7a6e561b1443ed20f722248b8a8a4e0faafe66031988ea

Comments