MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea6467cbc12cd239b436eba932757ab5f72f17949fc70656e18f08a2b9728a6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea6467cbc12cd239b436eba932757ab5f72f17949fc70656e18f08a2b9728a6e
SHA3-384 hash: 502fd1d990f74056639f7e3912788ccc612c208d40f98ed393ffb3fa02dc365670353748b68abf5774c5f423103da0bf
SHA1 hash: d0742c25f7ab1fe50866a8c18c952d93ecd30ae5
MD5 hash: e51ebf53b9869449421817e55583fb6d
humanhash: ceiling-fix-georgia-venus
File name:0900009000.uue
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:294'518 bytes
First seen:2021-02-10 08:53:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:VsPGxuXXfobD7e/9Ay9OYsgjevnbhFucz/UuxxQIJvI597:VsuxuQW95M5gsbhFxz/Ucxlk5
TLSH 3254231BF367B36787763E184E208756069A72486E188D9C83D8EC43F74A85FB4E35C9
Reporter abuse_ch
Tags:SnakeKeylogger uue


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: accounting@abkcoal.com
Subject: رد: فاتورة الدفع
Attachment: 0900009000.uue (contains "0900009000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea6467cbc12cd239b436eba932757ab5f72f17949fc70656e18f08a2b9728a6e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5jsgps6bftjdtnbw5oute5l2wx3s6f4ut7dqmvxbr4ekfolsrjxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea6467cbc12cd239b436eba932757ab5f72f17949fc70656e18f08a2b9728a6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip ea6467cbc12cd239b436eba932757ab5f72f17949fc70656e18f08a2b9728a6e

(this sample)

SnakeKeylogger

Executable exe 1dc2a4dd6e7e1525ff0e92f87bf12b95f62eb5750bdec7a41d40e49a3b2f9d81

  
Dropping
MD5 18fdfada20074a7e54f521d3e77d89df
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1dc2a4dd6e7e1525ff0e92f87bf12b95f62eb5750bdec7a41d40e49a3b2f9d81

Comments