MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbafa68af2a9bd9e91657d97b27a7e19e6d2ba045629a9ea5a1dd2724d74f443. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbafa68af2a9bd9e91657d97b27a7e19e6d2ba045629a9ea5a1dd2724d74f443
SHA3-384 hash: b0249afc791886967407c344a7ab992616f0471f25b449b78c5ad884aaaa9a2523b373d994b56fd2ecedb8658725c24f
SHA1 hash: 78babef13749f6b4b9feb412e4994b980927ecee
MD5 hash: 7ec5792de2273d33d0b0ee8875507e00
humanhash: cardinal-pluto-queen-jersey
File name:DHL_FORM_00029168874_PDF.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:653'237 bytes
First seen:2021-02-12 07:23:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JkfWR04LezM/mVWuvsB8pq7Kd/vGQ6Q5nu1TSVBrBX1rRtj8Dr:EGOVzxxd/n5nuaN7j8P
TLSH 82D433D0A4C9C9E3903FBC7C6D9303E8C15E5E358653B3A154139AA1A735BBB613A86C
Reporter abuse_ch
Tags:DHL rar SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: centoswp.internew.gr
Sending IP: 185.78.221.121
From: DHL EXPRESS (PL) <noreply@dhl.com>
Reply-To: result.box2019@mail.com
Subject: DOSTAWA DHL (POWIADOMIENIE O NIEPOWODZENIU)
Attachment: DHL_FORM_00029168874_PDF.rar (contains "DHL_FORM_00029168874_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbafa68af2a9bd9e91657d97b27a7e19e6d2ba045629a9ea5a1dd2724d74f443/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-12 10:56:33 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ox2ncxsvg6z5elfpwl3e6t6dhtnfoqekyu2t2s2dxjhetlu6rbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dbafa68af2a9bd9e91657d97b27a7e19e6d2ba045629a9ea5a1dd2724d74f443

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar dbafa68af2a9bd9e91657d97b27a7e19e6d2ba045629a9ea5a1dd2724d74f443

(this sample)

SnakeKeylogger

Executable exe e4284aaa6ccfa009dd95cc4d35c49f592d708453dec75a41390caf26781e638f

  
Dropping
MD5 93c895d8ac931f5bc82891ce69f66e39
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4284aaa6ccfa009dd95cc4d35c49f592d708453dec75a41390caf26781e638f

Comments