MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c7c03c33eab956d2a5039fdaeeff11c822caa8a20ef9d55b72de263161be0092. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SnakeKeylogger
Vendor detections: 6
| SHA256 hash: | c7c03c33eab956d2a5039fdaeeff11c822caa8a20ef9d55b72de263161be0092 |
|---|---|
| SHA3-384 hash: | ee0f0ca9bb8dc019a99e0d73755660c456e26c6227c0b44a4301959ad3a75f99a949b92a1a0ae3064da4a1726e52b7cb |
| SHA1 hash: | eaee0a521e2668f65064838eced6fa40175f0542 |
| MD5 hash: | a6ed59851a9dc2ca31e61707062381e7 |
| humanhash: | three-comet-nine-winner |
| File name: | shipping advice.zip |
| Download: | download sample |
| Signature | SnakeKeylogger |
| File size: | 302'429 bytes |
| First seen: | 2022-10-18 07:10:07 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 6144:yiNPrAc0oaNOQcWBkMqXNclC+k9oEnYaRBG7YbB4kqxRH:fPkNRcn5XNclk9oWnG7eBRqjH |
| TLSH | T1E9542374F42578EB43EEDB5808C64852FA55C097EA512B8219E5967A89F80FCECC01FF |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | INVOICE Shipping SnakeKeylogger zip |
cocaman
Malicious email (T1566.001)From: "SCHNEPP Magalie<Magalie.Schnepp@hubergroup.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.54]) "
Date: "18 Oct 2022 04:56:40 +0200"
Subject: "RE: B/L copy, Commercial Invoice, Packing List, Certificate of Origin and Commercial Invoice Certificate"
Attachment: "shipping advice.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
File Archive Information
This file archive contains 2 file(s), sorted by their relevance:
| File name: | version.txt |
|---|---|
| File size: | 1'708 bytes |
| SHA256 hash: | 26c2b9f6cd67730b8a47389f74f7b7397f53a60b98182ed98441fb1b0fb362c0 |
| MD5 hash: | 56ba4ffa9c86844c5fc587988ec58758 |
| MIME type: | application/octet-stream |
| Signature | SnakeKeylogger |
| File name: | 1 |
|---|---|
| File size: | 490 bytes |
| SHA256 hash: | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a |
| MD5 hash: | b7db84991f23a680df8e95af8946f9c9 |
| MIME type: | text/xml |
| Signature | SnakeKeylogger |
Vendor Threat Intelligence
Detection(s):
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2022-10-18 00:15:49 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5515611206:AAEcQSX8hXHOAxSYr8KUdLxGF5eqw4FRXoA/sendMessage?chat_id=1504449137
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
SnakeKeylogger
zip c7c03c33eab956d2a5039fdaeeff11c822caa8a20ef9d55b72de263161be0092
(this sample)
exe Delivery method
Distributed via e-mail attachment
Dropping
SnakeKeylogger
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.