MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6eb63858afa241915034f0e38ef048db360a6a1af4cd1a2f10f26de9712805c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CheetahKeylogger
Vendor detections: 3
| SHA256 hash: | 6eb63858afa241915034f0e38ef048db360a6a1af4cd1a2f10f26de9712805c5 |
|---|---|
| SHA3-384 hash: | cecd10a80a44e1b076eb68f5ba3ade168f448bd84657d86d44ddd014486ba803eee8977b79c2feee5a0562248e97e17c |
| SHA1 hash: | 0eadb54687751cfb330ffca3f43f6f322fe34148 |
| MD5 hash: | 3e338d856b8221d6b8794d84fab44e1c |
| humanhash: | ink-nevada-equal-zulu |
| File name: | Payment confirmation.exe |
| Download: | download sample |
| Signature | CheetahKeylogger |
| File size: | 346'112 bytes |
| First seen: | 2020-06-08 06:25:31 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:XKaUPSl6VEJD6LpuuDV8LiM1PRmR/hkGBuoEI4yYxkyn48:6aUG6VEt6z5LTBuNI4tO0 |
| Threatray | 739 similar samples on MalwareBazaar |
| TLSH | EA74AE3D718A41F4C4FF8633041AABC06A376B813696AB1F71EE63085F1374E7B6165A |
| Reporter |  abuse_ch |
| Tags: | CheetahKeylogger exe SCB |
abuse_ch
Malspam distributing CheetahKeylogger:HELO: outgoing4.jnb.host-h.net
Sending IP: 129.232.250.58
From: Standard Bank <noreply@standardbank.co.za>
Subject: Payment confirmation
Attachment: Payment confirmation.rar (contains "Payment confirmation.exe")
CheetahKeylogger SMTP exfil server:
mail.aviner.co.za:587
Intelligence
File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-06-08 06:27:04 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 729 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.