MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315
SHA3-384 hash: 4d218839761c33c6ac178a0685166e4651dea8d4c41b3370fa0ca85d54809786661a612a8148a8253ece7e7a906d6ac2
SHA1 hash: 975096b0eb385974f6210d34b190f6eb8638a625
MD5 hash: 7a1c5a7b5f77566b36fa05a3425ba423
humanhash: berlin-minnesota-november-spring
File name:Urgent RFQ_AP65425652_040621,pdf.iso
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:985'088 bytes
First seen:2021-04-07 06:00:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:2rzb5N3DEp+YDnxGZC+DR/1eG8aqwdJe3zXXkbUqV:29N3DEp+KnA0M1ejGdYb4
TLSH E425E02232956BA5E17E67359030512083F7FD97E332D68E3C9DB19C5B36AC2C262763
Reporter abuse_ch
Tags:iso SnakeKeylogger


Avatar
abuse_ch
Malspam distributing SnakeKeylogger:

HELO: cloudhost-1743008.us-midwest-1.nxcli.net
Sending IP: 209.87.159.184
From: Frank D <info@planteksilmet.com>
Subject: Urgent RFQ_AP65425652_040721
Attachment: Urgent RFQ_AP65425652_040621,pdf.iso (contains "Urgent RFQ_AP65425652_040621,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 02:45:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76joi6mg7f56azmu5l6hm57utgf64pbvkveubl5uhfl35escomkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

iso ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315

(this sample)

SnakeKeylogger

Executable exe 7c98a7aee7d155bc8632cae1ff09120f88483adfa77205e6b74253e9d652e2b6

  
Dropping
MD5 8c7db0f60114f1058474a48438072cac
  
Dropping
SnakeKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c98a7aee7d155bc8632cae1ff09120f88483adfa77205e6b74253e9d652e2b6

Comments