MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce6e6ebddcbd695f81f01a71c942354ccb5f005e686968c1945d9c7bd6d2dd64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce6e6ebddcbd695f81f01a71c942354ccb5f005e686968c1945d9c7bd6d2dd64
SHA3-384 hash: 9fc8c9869280c707d90c0081860406ae94e8b26aae20e6047ac7d47ab24e2703ce1568bd02d9521bc8cd21d2d129379d
SHA1 hash: 8fd374959dcff21b8fb1a7e830a35bd0ddb5e229
MD5 hash: a11f0afb4803b65a79f0102767d4b3d1
humanhash: ceiling-uranus-illinois-moon
File name:Shipping Documents Original BL, Invoice Packing List.img
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'441'792 bytes
First seen:2021-02-15 06:51:50 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:sl4XsYCvxGbhXycaJ1JY5U2OgwXtr2R72pn+ixmeE2wT:x9CpGdy9J1m5Vo2R7Cn+i8/1
TLSH 7E65BEAA3294AB94DC39733D91A1197053F3B65EB732D6CD7C9830C96613FC08361E9A
Reporter abuse_ch
Tags:DHL img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: dhl.com
Sending IP: 185.239.242.232
From: DHL | Global | Forwarding<dispatch@dhl.com>
Reply-To: DHL SHIPMENT <gana@ysu.am>
Subject: DHL Shipment Notification for sales
Attachment: Shipping Documents Original BL, Invoice Packing List.img (contains "Shipping Documents Original BL, Invoice & Packing List.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisF281E6F97227.15854.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce6e6ebddcbd695f81f01a71c942354ccb5f005e686968c1945d9c7bd6d2dd64/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 04:30:25 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zzxg5po4xvuv7apqdjy4sqrvjtfv6ac6nbuwrqmulwohxvws3vsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce6e6ebddcbd695f81f01a71c942354ccb5f005e686968c1945d9c7bd6d2dd64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img ce6e6ebddcbd695f81f01a71c942354ccb5f005e686968c1945d9c7bd6d2dd64

(this sample)

SnakeKeylogger

Executable exe 67108fc6d911e90188c65b91728152289ba95b48ab037fecf68822c818c4c812

  
Dropping
MD5 f281e6f97227cfdcb2edca1037fb0efb
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67108fc6d911e90188c65b91728152289ba95b48ab037fecf68822c818c4c812

Comments