MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5e81f087bb1eae412c4107097fb064d259e2bb7bc3170407189b085d421f87c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5e81f087bb1eae412c4107097fb064d259e2bb7bc3170407189b085d421f87c
SHA3-384 hash: 0629d96544cc55c957369f9cdfc986ac5b55956fcf7786becfa7c2b9f98f8dff6a6442c32a65c85a3ace2708c9a11c6f
SHA1 hash: 9c78a5417a43e3bb1af536b73e01e1d28de5112d
MD5 hash: d564ff197761f9af5959ea9dcf0179df
humanhash: video-monkey-nevada-romeo
File name:HYUNDAI MOTORS CCPP DC UPS SYSTEM RFQ DOCUMENT PDF.zip
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:663'403 bytes
First seen:2021-03-04 10:15:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:JzqyEW3rtAoDzwujXw2c9DIUoMcehUWUekwDQgz86PPBRnyRWCTF7X:oxytrwujS+xNSNY6PPBBnMX
TLSH 3EE433B4C7494F3789CB9A119DF352561B8027CD29F9888F88BED32DC64121B52B63DE
Reporter abuse_ch
Tags:SnakeKeylogger zip


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: benline.co.kr
Sending IP: 77.247.110.185
From: Jay PARK <jay.park@benline.co.kr>
Subject: URGENT [HYUNDAI MOTOR CCPP] DC & UPS SYSTEM / RFQ Issuance / Cut-off date : 2021-6-03
Attachment: HYUNDAI MOTORS CCPP DC UPS SYSTEM RFQ DOCUMENT PDF.zip (contains "HYUNDAI MOTORS CCPP DC & UPS SYSTEM RFQ DOCUMENT PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn53.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5e81f087bb1eae412c4107097fb064d259e2bb7bc3170407189b085d421f87c/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 10:16:08 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xub6cd3whvoiewecbyjp6ygjusz4k5xxqyxaqdrrgyilvbb7b6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/d5e81f087bb1eae412c4107097fb064d259e2bb7bc3170407189b085d421f87c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip d5e81f087bb1eae412c4107097fb064d259e2bb7bc3170407189b085d421f87c

(this sample)

SnakeKeylogger

Executable exe 83e31a3cff407361ba1a1475d1aef3d08792b9956b34b956c97e30a2e1e4a877

  
Dropping
MD5 9ae7c680c80292981ebd1c76c7857260
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83e31a3cff407361ba1a1475d1aef3d08792b9956b34b956c97e30a2e1e4a877

Comments