MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe649438245d1f891ca430ccdf7044dc4af70aa78a132f1014c4a2078a90ed1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe649438245d1f891ca430ccdf7044dc4af70aa78a132f1014c4a2078a90ed1e
SHA3-384 hash: f3907d7d6728472b3e2c6dd005e13a4806a9e0b84a5f74ce04004f9cacdf4e86da70882796c138910b9ada3b62243fac
SHA1 hash: e5f5519425f9e15964fb2c85c1b5e879a835ff55
MD5 hash: 5988c96560b562381df299ddec5e9fc6
humanhash: tango-kitten-queen-nineteen
File name:61007-51333893QR001U,pdf.CAB
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:757'760 bytes
First seen:2021-02-26 06:13:58 UTC
Last seen:Never
File type: cab
MIME type:application/x-iso9660-image
ssdeep 12288:QojE9WTfH2dp5CD1OuIDhwH8gIYPpJQ/ZLLRKvB+01:BTfWncxgyI+Q/ZLLRK04
TLSH 29F4CF0071BA0B56D9BC87F90555A24423F66D6E726EE72C1ECE31EB1B73B820A11F53
Reporter abuse_ch
Tags:cab SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: learsoft.com.ar
Sending IP: 190.210.215.185
From: Laura J. Martinez<pedidoschemetall-ar@basf.com>
Subject: 61007-51333893QR001U
Attachment: 61007-51333893QR001U,pdf.CAB (contains "61007-51333893QR001U,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe649438245d1f891ca430ccdf7044dc4af70aa78a132f1014c4a2078a90ed1e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:14:10 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zsjiobelupyshfegdgn64ce3rfpocvhrijs6eauysrapcuq5upa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

cab fe649438245d1f891ca430ccdf7044dc4af70aa78a132f1014c4a2078a90ed1e

(this sample)

SnakeKeylogger

Executable exe 6ac2c7507eb977807602d75b6df751b98ab56df542c85720e0cf84172d9b026d

  
Dropping
MD5 91bda606e41fe1005daa3a5a8db7cc73
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ac2c7507eb977807602d75b6df751b98ab56df542c85720e0cf84172d9b026d

Comments