MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf2c67175d6565dbaa0ac5d801fc31f483bedf7df310b5d356fde745f6941d67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf2c67175d6565dbaa0ac5d801fc31f483bedf7df310b5d356fde745f6941d67
SHA3-384 hash: 7b6a9937fed1990b45a330a6d0b6fae3682c2a9da4438bee7db143ce28bbf4486fb7b0d561ba33f3d00c945a3f7830d3
SHA1 hash: 2ec8b219d0b4ef3308dfb09c38d22859d6831e3e
MD5 hash: a5e3c689d7ea4deed87a6a3a35425c31
humanhash: beryllium-maryland-bravo-bakerloo
File name:Revised Invoice.r00
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:297'543 bytes
First seen:2021-02-02 07:47:35 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:8+pB5cAbzf8Dz5RbVLgIJMBKsJswcLgVNt9GDyv9JPo95DeGyOR8:ZcAbzCg1KsxcL6f9G09Jo956Gye8
TLSH 625423190BBDF145BAA4C72F4DA883049DE264D2F2FEF65293036094641FE4846F98FC
Reporter abuse_ch
Tags:r00 SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rim-tele.com
Sending IP: 188.128.84.2
From: <anup.khamkar@ultramaxit.com>
Subject: RE: REVISED INVOICE.
Attachment: Revised Invoice.r00 (contains "Revised Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf2c67175d6565dbaa0ac5d801fc31f483bedf7df310b5d356fde745f6941d67/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:48:13 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z4wgof25mvs5xkqkyxmad7br6sb35x356millu2w7xtul5uudvtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cf2c67175d6565dbaa0ac5d801fc31f483bedf7df310b5d356fde745f6941d67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

r00 cf2c67175d6565dbaa0ac5d801fc31f483bedf7df310b5d356fde745f6941d67

(this sample)

SnakeKeylogger

Executable exe 12f55950dc52aa9e607fcc04d3d2d2a58689a7ad8c1adbf58d04ac0c452ed5c0

  
Dropping
MD5 26ed080def875b35da216620b549fcfa
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 12f55950dc52aa9e607fcc04d3d2d2a58689a7ad8c1adbf58d04ac0c452ed5c0

Comments