MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6e4fbab28fdb2aafc62c07ed18714b5a756ae422fad83221a7ff32ce4a19710. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6e4fbab28fdb2aafc62c07ed18714b5a756ae422fad83221a7ff32ce4a19710
SHA3-384 hash: 7fd5fa800ce84415620b1b6684eb8f91e12b5d4a0abb7822b0a94477a362755e4ad38075e3a723d9266bbba6c53c60a5
SHA1 hash: 14b7ab54efd3af8f10675ade2913a38cd886818a
MD5 hash: 3fec35fc2615e84f96e0aac8446d91ed
humanhash: mobile-sweet-emma-leopard
File name:Product Specification742852.gz
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:516'575 bytes
First seen:2021-02-19 07:04:09 UTC
Last seen:2021-02-19 20:13:41 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:/plq4l5BtrT0psCXXEVml0UaNr5wk9OgUH2:DPl/9T0pXEVml0UknUH2
TLSH A4B42300D0AE4C0DBBB3DAF599887239E33354C3249705A9DB6CA3D1D61A76D0D8B6DD
Reporter abuse_ch
Tags:gz SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: ej0.eryfj.ml
Sending IP: 64.227.114.105
From: Zhang Kevin <a.link@heraeus.com>
Subject: P.O Inquiry
Attachment: Product Specification742852.gz (contains "Product Specification#742852.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45752766.19428.7074.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6e4fbab28fdb2aafc62c07ed18714b5a756ae422fad83221a7ff32ce4a19710/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-19 01:43:26 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=63spxkzi7wzkv7dcyb7ndbyuwwtvnlscf6wygiq2p7zszzfbs4ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6e4fbab28fdb2aafc62c07ed18714b5a756ae422fad83221a7ff32ce4a19710

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

zip f6e4fbab28fdb2aafc62c07ed18714b5a756ae422fad83221a7ff32ce4a19710

(this sample)

SnakeKeylogger

Executable exe 6275a11bba81d765d92e670a44888734f565eb11fd137a0ff852ed5df68c1d67

  
Dropping
MD5 bf1a2c49f949c491f42f4755caa1a21f
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6275a11bba81d765d92e670a44888734f565eb11fd137a0ff852ed5df68c1d67

Comments