MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f340be14c37a33fc12a4bafe257e56000302d8c9839b2e9bcafde248da1c0eef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f340be14c37a33fc12a4bafe257e56000302d8c9839b2e9bcafde248da1c0eef
SHA3-384 hash: 93d72388e7e5f327757d009c93bb2c8e4b3b16e1a069e554eecf7975d7b0b75625907ecbb9c91916ba8653b580bbc2d6
SHA1 hash: 6250e1cf2558435e67f00ae21e9fc8f52955f52e
MD5 hash: e7c3021540c040ce7ad46ce59c11e8d0
humanhash: kansas-zulu-rugby-robert
File name:PO_1037_Scanned_150.lzh
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:513'123 bytes
First seen:2021-03-05 13:01:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:xwrDLErvz6sjIDO5xkhOh764O390Pw/3kBL+TTMBR6NNVFOX:xw4H6qID7hOo4wMhUMBR63FOX
TLSH 1AB42385D2B7C396392E179143CB12A2FCFC5DC35270391183EADD612DF91A226EC6CA
Reporter abuse_ch
Tags:Hetzner lzh SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: static.228.224.217.95.clients.your-server.de
Sending IP: 95.217.224.228
From: BEmma Nevard<website@ctggrocer.com>
Subject: Purchase Order 1037 from Europower Components Ltd
Attachment: PO_1037_Scanned_150.lzh (contains "PO_1037_Scanned_150.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f340be14c37a33fc12a4bafe257e56000302d8c9839b2e9bcafde248da1c0eef/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:02:07 UTC
AV detection:
8 of 43 (18.60%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nal4fgdpiz7yevexl7ck7swaabqfwgjqons5g6k7xrerwq4b3xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f340be14c37a33fc12a4bafe257e56000302d8c9839b2e9bcafde248da1c0eef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar f340be14c37a33fc12a4bafe257e56000302d8c9839b2e9bcafde248da1c0eef

(this sample)

SnakeKeylogger

Executable exe 7e3852e9aef15433ea96a868fdb0da68aa2292108c8f1b7f869573aa0145c7d3

  
Dropping
MD5 b986d0262d0071dda5b710a1e02d11e3
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e3852e9aef15433ea96a868fdb0da68aa2292108c8f1b7f869573aa0145c7d3

Comments