MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d971fce7689a2c5a24f69529183bdb43b852ee67aea5624d520f144b7b558ba2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d971fce7689a2c5a24f69529183bdb43b852ee67aea5624d520f144b7b558ba2
SHA3-384 hash: bd3a2783537f11b692aa93c2730644b29afdd3e41bb57c27da4de90dcec4523e71ecae8fd58b090b8ac3684fe370e8d9
SHA1 hash: deb16554510c7ca36c739ffa8521cbbf3a0066ca
MD5 hash: 4d5489961121a5d9e50cfda18d03f0dc
humanhash: earth-stream-five-angel
File name:RFQ 978002410.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:444'627 bytes
First seen:2021-03-26 13:58:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:7yAqjiQVR/XjoHVBm9xs8XLey85PAvLS26:OZu2RkHVBm08Xt85P6LSf
TLSH AE9423FAA951D4F820F8E0AA48EFE4D749EB352174C5979F96B43CAD2C0F1A14C60F15
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Ali Mohamed Al Suwaidi <cliente@tuaol.com>" (likely spoofed)
Received: "from mail.good-hills.co.jp (www18057ui.sakura.ne.jp [153.120.2.71]) "
Date: "26 Mar 2021 06:57:31 -0700"
Subject: "ADNOC RFQ 978002410 | URGENT |SUPPLIES"
Attachment: "RFQ 978002410.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d971fce7689a2c5a24f69529183bdb43b852ee67aea5624d520f144b7b558ba2/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-26 13:58:05 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3fy7zz3itiwfujhwsuurqo63io4ff3thv2swetksb4kew62vrora._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/d971fce7689a2c5a24f69529183bdb43b852ee67aea5624d520f144b7b558ba2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar d971fce7689a2c5a24f69529183bdb43b852ee67aea5624d520f144b7b558ba2

(this sample)

SnakeKeylogger

Executable exe 1cb72e88f71e5c7ad0ee9ecaf45f9952275c90fe80c24c63507d039a68f6c539

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1cb72e88f71e5c7ad0ee9ecaf45f9952275c90fe80c24c63507d039a68f6c539

Comments