MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46933cc254d90ae3747da1a294eeb20b0484e8bb3abc0d97c9c3136b268bcd1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46933cc254d90ae3747da1a294eeb20b0484e8bb3abc0d97c9c3136b268bcd1f
SHA3-384 hash: e0e6b4a9852439141e9dbd62715269d2abddd0c7476f8ce001c5a8259acb834b1800130a34344dc1d8b03c9bfae5f300
SHA1 hash: ba60f95a9c47e7449d24b5e3a0d97b481cfe0498
MD5 hash: 10b97e651c0568ab079d0d89b6c6ed82
humanhash: freddie-sixteen-south-august
File name:Payment confirmation.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:193'847 bytes
First seen:2020-06-08 06:25:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:0si/UAd4fD2R3WhA0Kq2lJ/wEi+LUpr8EHi/GVtWc2wuDNVdV8DGt1OKhAZ/1jKa:TkVIA3WEi+wprM/eAc2wuXdV8CtUdd1Z
TLSH 5414228D933B96964A14EBCDA837E0BDDA8CC495409C90438B2CE4EFF07A370686795D
Reporter abuse_ch
Tags:CheetahKeylogger rar SCB


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing4.jnb.host-h.net
Sending IP: 129.232.250.58
From: Standard Bank <noreply@standardbank.co.za>
Subject: Payment confirmation
Attachment: Payment confirmation.rar (contains "Payment confirmation.exe")

CheetahKeylogger SMTP exfil server:
mail.aviner.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:27:03 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2jtzqsu3efog5d5ugrjj3vsbmcij2f3hk6a3f6jymjwwjulzupq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar 46933cc254d90ae3747da1a294eeb20b0484e8bb3abc0d97c9c3136b268bcd1f

(this sample)

CheetahKeylogger

Executable exe 6eb63858afa241915034f0e38ef048db360a6a1af4cd1a2f10f26de9712805c5

  
Dropping
MD5 3e338d856b8221d6b8794d84fab44e1c
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6eb63858afa241915034f0e38ef048db360a6a1af4cd1a2f10f26de9712805c5

Comments