MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daebc53ea165df89d710f65de8411918c027ea4adb6019d21d1fda44bb3b6ff3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daebc53ea165df89d710f65de8411918c027ea4adb6019d21d1fda44bb3b6ff3
SHA3-384 hash: af05d73d3dc58aace248cbd56dede9584b514bcb492faa87439fc1ab93146316217de08f6a9e4dd6df0c08e8b7497c92
SHA1 hash: 36cd28ea73dc8cfec32e154969fd169dc2af564e
MD5 hash: 13b1e12f195f728982b54017b93056af
humanhash: hamper-shade-earth-magnesium
File name:ve �eki listesi ektedir Proforma.r11
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:686'149 bytes
First seen:2021-05-12 07:12:36 UTC
Last seen:2021-05-14 05:09:08 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:lOQPJIbGmdtN8r1DF0ISPgwTGY7m7e+VOnLIgJPGTrXdjYGvEu+wi:ljPuF9ISPfD/+IpJ+tjY9u+Z
TLSH C5E4235CFB408DF1F60A9DB2A0D22FC2255AAF04F1D5C62EA5392AD1AF3537A9177101
Reporter cocaman
Tags:r11 SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?TWVodmXFnyBUQVlGVU4gKEFuYmEgWWF5xLFuIEdydWJ1KQ==?= <mehves.tayfun@anba.com.tr>" (likely spoofed)
Received: "from anba.com.tr (unknown [45.137.22.71]) "
Date: "12 May 2021 09:04:56 -0700"
Subject: "Re: Proforma ve paket listesi ektedir .."
Attachment: "ve �eki listesi ektedir Proforma.r11"

Intelligence

File Origin
# of uploads :
3
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daebc53ea165df89d710f65de8411918c027ea4adb6019d21d1fda44bb3b6ff3/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-05-12 07:13:13 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lv4kpvbmxpytvyq6zo6qqizddacp2sk3nqbtuq5d7nejoz3n7zq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger spyware stealer
Link:
https://tria.ge/reports/210512-ac73s5jcpa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/daebc53ea165df89d710f65de8411918c027ea4adb6019d21d1fda44bb3b6ff3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar daebc53ea165df89d710f65de8411918c027ea4adb6019d21d1fda44bb3b6ff3

(this sample)

SnakeKeylogger

Executable exe 2fad6702a020c41528d045300f1e3d37469847f719ce27ec67e88098a257ecb0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2fad6702a020c41528d045300f1e3d37469847f719ce27ec67e88098a257ecb0
  
Dropping
SnakeKeylogger

Comments