MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd82f0f763a9549b77cd46d376a8e3251f534ac1536201e79b1c89168800d28e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd82f0f763a9549b77cd46d376a8e3251f534ac1536201e79b1c89168800d28e
SHA3-384 hash: 36205a5b0a6d50417d333cedc422f34ba195cc432b3866317fcfaa8c27fe1413c766ab4ea1c03beea01ce313b795dbc5
SHA1 hash: f71f9bc7c52d61c204c0c5c1dd40ecbb2afcaa7e
MD5 hash: 861b65d959d9d036449cf3e37332e2ca
humanhash: fourteen-earth-bacon-social
File name:parcel_document003,pdf.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:429'129 bytes
First seen:2021-03-03 18:14:42 UTC
Last seen:Never
File type: zip
MIME type:application/x-rar
ssdeep 6144:rEWUdt584jJZuk0ySruSIduzzoVLCZAMN/DOUPBbuDGYRAW9ephaSCl:rEWe04jJk7yVSMGz2OZDRZsn9e3abl
TLSH B29423954ADF3620525F1C534D8C4B00BBA23F4DDAFC2EA341492E47F745A5FE7A10AA
Reporter abuse_ch
Tags:DHL SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: v198.ncsrv.de
Sending IP: 89.110.144.212
From: DHL <gina.ruiz@dhl.com>
Subject: ***Virus*** Re: DHL Delivery
Attachment: parcel_document003,pdf.zip (contains "parcel_document003,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd82f0f763a9549b77cd46d376a8e3251f534ac1536201e79b1c89168800d28e/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 18:15:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwbpb53dvfkjw56ni3jxnkhdeupvgswbknradz43dserncaa2kha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/cd82f0f763a9549b77cd46d376a8e3251f534ac1536201e79b1c89168800d28e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip cd82f0f763a9549b77cd46d376a8e3251f534ac1536201e79b1c89168800d28e

(this sample)

SnakeKeylogger

Executable exe 8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5

  
Dropping
MD5 15f0423cfda5eedcb0f73022c28d9eca
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c60e4c3f801f1054e43e5fd1bc9910b29584b3db99f2224684e0343188b89d5

Comments