MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2cf7ced81d8b20db6f07681ce59c87c004c8716075b2fa69c92eafacb05fe2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2cf7ced81d8b20db6f07681ce59c87c004c8716075b2fa69c92eafacb05fe2e
SHA3-384 hash: baa02acf9ac201853808329ed84d8d909b73bdd1263d2ebe70e1356af1aeffba7df2576c8ea95c5d1bcb487f420ffe39
SHA1 hash: 1199e08b0663e67f235f18c78eed4efee9ab6b73
MD5 hash: d7924698354902050aefab7660563fbf
humanhash: bravo-montana-arizona-ack
File name:Bank Transfer Form -pdf- .arj
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:253'369 bytes
First seen:2020-08-08 08:22:52 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:EWozP32P5LQ+oLTCLrAUMof7hyan43Ud2Ve7QCqv/OJKS:Do7WlQVOLpjhdEFkqv/jS
TLSH BC442387D4A9FE6B86FD38982D5F4BC8444ED1CA25912BE9D31D25B063C430E3161BFA
Reporter abuse_ch
Tags:404Keylogger arj ESP geo


Avatar
abuse_ch
Malspam distributing 404Keylogger:

HELO: employmentlinknepal.com
Sending IP: 23.106.223.20
From: Accounts <madhukar@employmentlinknepal.com>
Subject: Fwd: Formulario de transferencia bancaria
Attachment: Bank Transfer Form -pdf- .arj (contains "Bank Transfer Form -pdf- .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2cf7ced81d8b20db6f07681ce59c87c004c8716075b2fa69c92eafacb05fe2e/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:24:08 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulhxz3mb3cza3nxqo2a44woipqaezbywa5ns7ju4slvpvsyf7yxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a2cf7ced81d8b20db6f07681ce59c87c004c8716075b2fa69c92eafacb05fe2e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

arj a2cf7ced81d8b20db6f07681ce59c87c004c8716075b2fa69c92eafacb05fe2e

(this sample)

404Keylogger

Executable exe f92b54d3c97015bf592fc80c6a7cea7eed7d35d423fbbb612e84bb91c92b8320

  
Dropping
MD5 2978510bf17fa0d135d00fe79ef89a1f
  
Dropping
404Keylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f92b54d3c97015bf592fc80c6a7cea7eed7d35d423fbbb612e84bb91c92b8320

Comments