MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef8988dca10edb6f5bc8ebc1ea26a402bc63773d37be86983664f166de3c925b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef8988dca10edb6f5bc8ebc1ea26a402bc63773d37be86983664f166de3c925b
SHA3-384 hash: 244658730bab3fa9119ce85bd2a92c6a108f83c3ad661101e5907d302343b2cc28615c972ef780e5e801562bdb33ab3b
SHA1 hash: 35822bb6428aa747f48811eef03694b1d999ed4c
MD5 hash: 4c93606e9640c77198df052c111dcff4
humanhash: cold-stairway-alanine-video
File name:ORIGINAL INVOICE09000.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:515'617 bytes
First seen:2021-02-09 12:12:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Y19sr2ysKwsW+ISAE85XlP8qd+Y0Mst5410/ZunOG1AFRbLpO:Y1Kr2JYCSpyVi5410/ZuQ1FO
TLSH 90B423A241FB4CECC1E636E0A95CC72203916AA2CD8B89979D67F487C3D5F7150DF4A8
Reporter abuse_ch
Tags:lzh SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: accounting@abkcoal.com
Subject: Fatura de pagamento de saldo
Attachment: ORIGINAL INVOICE09000.lzh (contains "ORIGINAL INVOICE09000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef8988dca10edb6f5bc8ebc1ea26a402bc63773d37be86983664f166de3c925b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 12:13:08 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=56eyrxfbb3nw6w6i5pa6ujveak6gg5z5g67ingbwmtywnxr4sjnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef8988dca10edb6f5bc8ebc1ea26a402bc63773d37be86983664f166de3c925b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip ef8988dca10edb6f5bc8ebc1ea26a402bc63773d37be86983664f166de3c925b

(this sample)

SnakeKeylogger

Executable exe da039f0ea44820791cca823e019218e9927c6dfe22d6c0f23063521cb0038c22

  
Dropping
MD5 3ef7ddeec547aa029071a827a57aeb97
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da039f0ea44820791cca823e019218e9927c6dfe22d6c0f23063521cb0038c22

Comments