MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f05b68abdacfb73f82c36202e7ac88fa9a1d6d20716543692b840222b7a3fef3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f05b68abdacfb73f82c36202e7ac88fa9a1d6d20716543692b840222b7a3fef3
SHA3-384 hash: 98530ec5f8d0a1a7caec98ce89ee08665a9c1cf3b8f745065615081b3247e32b474ec2626fb1571b022d61286bbbba76
SHA1 hash: 37c2d08f0daacd20113f19932d9106357eab043b
MD5 hash: 59cd5ccff664f2ff69cf39397f5c3bc7
humanhash: william-blue-white-music
File name:DHL Original Invoice_pdf.rar
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:442'551 bytes
First seen:2021-06-17 10:04:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:muO8dHZTuMIZv8QmrgSbQGW3n2d2FI71P:NPOMqv8Qqrd2+P
TLSH B894239C778854526E44936700F9166AB03C0E1B65508091BBCDB6CDF9C39B7E88FA8E
Reporter cocaman
Tags:DHL INVOICE rar SnakeKeylogger


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?REhMIEVYUFJFU1MgSU5Dwq4=?= <support@225.mxvmno.ml>" (likely spoofed)
Received: "from hp0.225.mxvmno.ml (hp0.225.mxvmno.ml [164.90.136.114]) "
Date: "17 Jun 2021 03:03:07 -0700"
Subject: "CONSIGNMENT NOTIFICATION: You Have A Package With Us:"
Attachment: "DHL Original Invoice_pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f05b68abdacfb73f82c36202e7ac88fa9a1d6d20716543692b840222b7a3fef3/
Threat name:
Win32.Worm.LovGate
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 10:05:20 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bnwrk62z63t7awdmiboplei7knb23jaofsug2jlqqbcfn5d73zq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger keylogger stealer
Link:
https://tria.ge/reports/210617-vv88jcs6vn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Snake Keylogger
Snake Keylogger Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/f05b68abdacfb73f82c36202e7ac88fa9a1d6d20716543692b840222b7a3fef3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar f05b68abdacfb73f82c36202e7ac88fa9a1d6d20716543692b840222b7a3fef3

(this sample)

SnakeKeylogger

Executable exe 6d22e09e56ea48a1f1f3e84a511bae12f9aac12025e722c4463f845fe6495c5b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d22e09e56ea48a1f1f3e84a511bae12f9aac12025e722c4463f845fe6495c5b
  
Dropping
SnakeKeylogger

Comments