MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a33abbdc09596b55586fde9019e0e7a59e591b3611c3683d8d4d21cd098d082f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a33abbdc09596b55586fde9019e0e7a59e591b3611c3683d8d4d21cd098d082f
SHA3-384 hash: 2bc61d6025fce4f7e3219e45385a1da303505f4d28e5384410262050af492782865139d1d9be45fbd5bb847d4a1493c5
SHA1 hash: 4d670fad47ae0fb8979fc4e9e4cdf655477863aa
MD5 hash: 3749c6ec5930f671cf50aa4c694c2ba2
humanhash: mockingbird-seven-july-mobile
File name:Payment Notification.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:180'594 bytes
First seen:2020-05-04 09:28:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:crxlcs9uMq/qKB7sGO7LvV+FvNQJk76/ZaSIUBqRigFPHPExWpK7xdFCyDN:0xVul/IzLvGlG46nEfMEpK7HNh
TLSH 700412F007B2F090E70CE1A06F559FD99B41BF9DCE93ED8B3AA410CA899BC9C994515C
Reporter abuse_ch
Tags:CheetahKeylogger rar


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing33.cpt4.host-h.net
Sending IP: 196.40.103.43
From: Paymentsemail@fnb.co.za <Payment@fnb.co.za>
Subject: Payment Notification
Attachment: Payment Notification.rar (contains "Payment Notification.exe")

CheetahKeylogger SMTP exfil server:
pnasc.co.za:587

CheetahKeylogger SMTP exfil email address:
jaco@pnasc.co.za

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 09:35:35 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=um5lxxajlfvvkwdp32ibtyhhuwpfsgzwchbwqpmnjuq42cmnbaxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar a33abbdc09596b55586fde9019e0e7a59e591b3611c3683d8d4d21cd098d082f

(this sample)

CheetahKeylogger

Executable exe ff1ce7f6b30bf528b3b97c498f3bf0967443e912891c258b39533ef6efd51f1c

  
Dropping
MD5 8994d3da90df156b7a0c7d2063496852
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff1ce7f6b30bf528b3b97c498f3bf0967443e912891c258b39533ef6efd51f1c

Comments