MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5
SHA3-384 hash:	8df75b5076d7ddaf94204ff5c07101ed388902b79936b9044e7c936fafe784c8f760091abfa09cb265d85801ead91cfb
SHA1 hash:	4bcaf067b3fab4e2212e5f078081276cf2d5f7fa
MD5 hash:	e0e497c2b1f8cfa0805de272f2f7d162
humanhash:	pip-florida-victor-missouri
File name:	Original Shipping documents.r00
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	668'356 bytes
First seen:	2023-03-08 13:01:19 UTC
Last seen:	Never
File type:	r00
MIME type:	application/x-rar
ssdeep	12288:raM/+8NXD1hkNfyJFslSWPL5XwJ4Q2U+jWMW39q0ybYqpgt/31ZHvETo8nPia8Rg:JTyK8hFAJZ2/WMqqRMqpgt31doAjPJg
TLSH	T152E423019BAEFA7F73E49B311555676C18D3A94A6AA3778B7B40A1FC00B34D43F32164
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	r00 Shipping SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "INFO <info@rishinishigraphics.com>" (likely spoofed)
Received: "from rishinishigraphics.com (unknown [45.137.22.75]) "
Date: "8 Mar 2023 14:00:00 +0100"
Subject: "RE: RE: DRAFT OF B/L Original Shipping documents"
Attachment: "Original Shipping documents.r00"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Original Shipping documents.exe
File size:	848'896 bytes
SHA256 hash:	18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285
MD5 hash:	c361028b8a49cb6686572effc5f18bc5
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20230308-1336.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6408874bed3d33698044bd95/reports/a065ce4a-4c02-43db-93b6-abc424211e11/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2023-03-08 05:38:26 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 25 (64.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3vdcf6lqavt736jmi4ikyc6uxnco3k3tv3c7iazzyylaw277dxsq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.