MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b09757ac96b9560ef40880d542b3a97fbff5118739ed748590f4e47a83b2026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b09757ac96b9560ef40880d542b3a97fbff5118739ed748590f4e47a83b2026
SHA3-384 hash: eae02bda7dd06354645f5f060b57195a60e7e9fd9d791d5b51e66d9b6fad304aebb8e10c01e5c75d1f8e62064c5658c8
SHA1 hash: 8e4c0681ff25f3b5e4b29ab224aec2830da5867c
MD5 hash: c7bb86a76fa0ad71633ebd45bb170400
humanhash: skylark-wisconsin-enemy-skylark
File name:PO23294248429.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:166'731 bytes
First seen:2020-08-31 11:22:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:KpfuncAVlmLyO9Aq1BdPpN8Kr0rXr0PmLwYT8x+bE48QX9g6KiLXQEax:KlMcIrzWoKrFPmkxx+bEShzxq
TLSH 6BF3124FA31AB9544A4FEC25526281487312EAC8C76E37E577FCBFB12D2568B60C3E14
Reporter abuse_ch
Tags:CheetahKeylogger rar


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing29.jnb.host-h.net
Sending IP: 129.232.250.45
From: Laura Hannemann <laura.hannemann@momentumconsults.co.za>
Subject: Fwd: Invoice Payment
Attachment: PO23294248429.rar (contains "PO23294248429.exe")

CheetahKeylogger SMTP exfil server:
mail.aviner.co.za:587

CheetahKeylogger C2:
http://cheetahkeylogger.xyz/API/plan.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b09757ac96b9560ef40880d542b3a97fbff5118739ed748590f4e47a83b2026/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 05:01:58 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tmexk6wjnokwb32aragvikz2s7576uiyoopnosczb5hepkb3eata._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b09757ac96b9560ef40880d542b3a97fbff5118739ed748590f4e47a83b2026

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar 9b09757ac96b9560ef40880d542b3a97fbff5118739ed748590f4e47a83b2026

(this sample)

CheetahKeylogger

Executable exe e8f02457c0ce811c8b7e3574ec86609d52021d2cb59782ee6ef1efb0bb6e0af2

  
Dropping
MD5 1eae5284068cbc12ec56e10c79a7373a
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8f02457c0ce811c8b7e3574ec86609d52021d2cb59782ee6ef1efb0bb6e0af2

Comments