MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75
SHA3-384 hash: 5e247c107c75975a2534a7ae90b50b34a77419f9385bcc16070b7fb505b60c813eb947d8a33302d1d665809d088919c5
SHA1 hash: e710ca43ed2f2dcfda374abe8bb67585d4d48510
MD5 hash: 17e009059e769439a5e74d4111c9421e
humanhash: triple-rugby-mexico-high
File name:Telex Transfer.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:484'312 bytes
First seen:2021-02-24 06:30:08 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:1e16v7MxowPNn0bYLgwAT2mQ+57RuTJY2NkUQwE4F3up7M6wC4IXlvECK5mE0:1ix510U/AT2mQ0uBjxIF4ClUK
TLSH 78A423587181A8D88E0F2CB661F53CEE4C0B5F16A191CDB95C4976E7E8C8272E63A731
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: vps.tecp0s.com
Sending IP: 203.159.80.121
From: office1@tecp0s.com
Subject: TELEX TRANSFER
Attachment: Telex Transfer.gz (contains "Telex Transfer.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 06:30:16 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4d3hiey5zwpn4e7sjilzwlln3izprrydkosj73suivy32jy4zz2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

gz e0f674131dcd9ede13f24a179b2d6dda32f8c70353a49fee544571bd271cce75

(this sample)

SnakeKeylogger

Executable exe 98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f

  
Dropping
MD5 b8b17a24058b530649a6caea020a2abf
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98a53af9d196562466ac85faa2c1c4c62d4646f9c3e1040df4396e08adbe3a1f

Comments