MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f134a3b075d158d8cb5d0009bd4855dce16b5ba4c154d24995ffec6b151cdb32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f134a3b075d158d8cb5d0009bd4855dce16b5ba4c154d24995ffec6b151cdb32
SHA3-384 hash: 91bc172333ed1f075d06e455d9ade316874297e4025d240d9964369a57cbbeda8dcd40c3f23404ff12e07d6c0ddeaa9d
SHA1 hash: d2c20d9dceee531a444f426cec9286cea479533d
MD5 hash: dc265c755c2e2b3db78adaa36fe9dc02
humanhash: west-twenty-lithium-august
File name:09000009099.LZH
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:282'280 bytes
First seen:2021-02-05 18:14:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:vBoYeO1b45sQBzH4i9MXTVcTCeA8tFyIC2kU4TCQMcFZ34lRO308G:m3O5IsmHB9WGnKICe4ZMcFZij
TLSH 4554235908B2A92101F3758E66647838C625B8FFC35BC1937FF276385A0DA36CA46D7C
Reporter abuse_ch
Tags:lzh


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: abdoelfarouk1@hotmail.com
Subject: แจ้งชำระเงิน 27 ม.ค. 2564
Attachment: 09000009099.LZH (contains "09000009099.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f134a3b075d158d8cb5d0009bd4855dce16b5ba4c154d24995ffec6b151cdb32/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 01:38:30 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6e2khmdv2fmnrs25aae32scv3tqwww5eyfknesmv77wgwfi43mza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f134a3b075d158d8cb5d0009bd4855dce16b5ba4c154d24995ffec6b151cdb32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip f134a3b075d158d8cb5d0009bd4855dce16b5ba4c154d24995ffec6b151cdb32

(this sample)

SnakeKeylogger

Executable exe 1010802153f7262f1cb83c571e7dd9eec0d525f5a6846e5fb78c0ac21fac89d6

  
Dropping
MD5 075667e87400dc031ea11cbeeb111aed
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1010802153f7262f1cb83c571e7dd9eec0d525f5a6846e5fb78c0ac21fac89d6

Comments