MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccc4e2eafdbe696bab0ac0db28b0d1c6f9bc4159a3ec6b5fd20b29bff1ea4236. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccc4e2eafdbe696bab0ac0db28b0d1c6f9bc4159a3ec6b5fd20b29bff1ea4236
SHA3-384 hash: ca3c800cc7df5c1a76ff4330c114f04081d4b827b20f1cebdf34da08f9720aa4c4ba20f0cf363e25251902a8a13af6ba
SHA1 hash: 7768daec9523437507236162cb5eb8bccc47b19c
MD5 hash: b3083827e9dfda8a85e614503e668876
humanhash: failed-double-chicken-cardinal
File name:BL NO. HDMUBUNS7240428.cab
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:553'729 bytes
First seen:2021-02-11 13:07:01 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:BSqeKErEX/e37S25ZQX1Od8bBgbWWAoZOY3WUz9p1/lK:BSlrE2e2DQFO8MZOYdz9vNK
TLSH D7C423B4E95539C2B143C8F0E6CBE9433BE3F0092E6C4ADD09C3557229929514B6EEB7
Reporter abuse_ch
Tags:cab GoDaddy SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: sg2nlsmtp01.shr.prod.sin2.secureserver.net
Sending IP: 182.50.132.200
From: Eileen Bendayan <aralinahabi@gmail.com>
Subject: Re: Import BL NO. HDMUBUNS7240428
Attachment: BL NO. HDMUBUNS7240428.cab (contains "BL NO. HDMUBUNS7240428.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisB3349B2E150C.30110.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccc4e2eafdbe696bab0ac0db28b0d1c6f9bc4159a3ec6b5fd20b29bff1ea4236/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 15:00:04 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ztcof2x5xzuwxkykydnsrmgry343yqkzupwgwx6sbmu374pkii3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ccc4e2eafdbe696bab0ac0db28b0d1c6f9bc4159a3ec6b5fd20b29bff1ea4236

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab ccc4e2eafdbe696bab0ac0db28b0d1c6f9bc4159a3ec6b5fd20b29bff1ea4236

(this sample)

SnakeKeylogger

Executable exe 207b22963b7478890160b3bf5f6c905b0d9e956029ff907b3c606c19077405f2

  
Dropping
MD5 b3349b2e150c40b0a3a3039e04b73eff
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 207b22963b7478890160b3bf5f6c905b0d9e956029ff907b3c606c19077405f2

Comments