🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e168a6044246feecae974ff32ac61559ff57c410f8a8ba1015b6c27c20b06ccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e168a6044246feecae974ff32ac61559ff57c410f8a8ba1015b6c27c20b06ccc
SHA3-384 hash: 370f7dc335cdc10b28de411d4291eea910a92f191a09e202d250806c380ed79c87d49fc3cd3070393f4541138c6abed7
SHA1 hash: a8bd6fb7309cba4090ac47740abe17a992b77a61
MD5 hash: 367e0ce22cb9a524032e526a56aff948
humanhash: eleven-charlie-massachusetts-crazy
File name:IMG_2021_01_13_1_RFQ_PO_1832938.IMG
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:1'572'864 bytes
First seen:2021-01-13 15:58:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:txaYippREEztEGl7Lw1pZu6a49DCKvRbWZ12/YOUOJ2NwcXmTrHf:IpLCGl7LMpZda49DCKkZ12/XJ2Nw7H/
TLSH 30754903BBDC970CE3BD26BD383000611AE5EF27A6B8D61CF9C1A46D5A6291845FD7D2
Reporter abuse_ch
Tags:img SnakeKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.rajo.com.br
Sending IP: 162.241.40.68
From: shmulik <shmulik@bcid-co.me>
Reply-To: shmulik <shmulik@bcid-co.me>
Subject: Re: Re: MT25QU256ABA8ESF-0SIT  51Kpcs
Attachment: IMG_2021_01_13_1_RFQ_PO_1832938.IMG (contains "IMG_2021_01_13_1_RFQ_PO_1832938.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e168a6044246feecae974ff32ac61559ff57c410f8a8ba1015b6c27c20b06ccc/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 15:59:05 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4fukmbcci37ozluxj7zsvrqvlh7vpraq7culueavw3bhyifqntga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e168a6044246feecae974ff32ac61559ff57c410f8a8ba1015b6c27c20b06ccc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

img e168a6044246feecae974ff32ac61559ff57c410f8a8ba1015b6c27c20b06ccc

(this sample)

SnakeKeylogger

Executable exe c21af7bb95c19c612a239b33474ff9167efe84e3ae69b9b727b75401e2e81670

  
Dropping
MD5 c82ca6c32016c3867edf5263e33687f8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c21af7bb95c19c612a239b33474ff9167efe84e3ae69b9b727b75401e2e81670

Comments