MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d0118ae8d12bbac8a0850b8e3b709229aa024c7f8a88a9d03b5e87c78f9c93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d0118ae8d12bbac8a0850b8e3b709229aa024c7f8a88a9d03b5e87c78f9c93
SHA3-384 hash: bf6c47f30c81cf8114b8f466d269aaf85a26e8c9fb77a33f8d91daebcf730b0f7f573617bc0d17aaf0fde9a9f5587069
SHA1 hash: 81c94d061c9413720ddb38cec7d398262c772d03
MD5 hash: 4da7711e0553aca9245f2756fcbda3a0
humanhash: earth-pluto-bluebird-lake
File name:Telex transfer.7z
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:611'217 bytes
First seen:2021-03-09 12:02:39 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:dJmbNT6cmNrdvi4YZvRoGHTW9uzMKWByW2m:sNT6rspouTWNKsyu
TLSH DAD423F3B36C84C2D8DB662D147F64C23728D5E4076496CDEC9E75B222CB6B5AB4C086
Reporter abuse_ch
Tags:7z SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cl-t002-054cl.privatedns.com
Sending IP: 64.15.155.21
From: smtp-h3asi@australiastartups.org
Subject: Telex transfer (TT)
Attachment: Telex transfer.7z (contains "Telex transfer.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3477.15509.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 12:03:19 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tibdcxi2ev3vsfaqufy4o3qsiu2uasmp6firkoqhnpipr4ptsjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4d0118ae8d12bbac8a0850b8e3b709229aa024c7f8a88a9d03b5e87c78f9c93

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

7z d4d0118ae8d12bbac8a0850b8e3b709229aa024c7f8a88a9d03b5e87c78f9c93

(this sample)

SnakeKeylogger

Executable exe 933c59b472b918b70a0fa3ad9f647c793405f4256a5185794444a522b15cdcb8

  
Dropping
MD5 3ffe2ec84f3aa32818d8a94858adae7b
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 933c59b472b918b70a0fa3ad9f647c793405f4256a5185794444a522b15cdcb8

Comments