MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f073720cea2de6afedd9ae33af93a3ea5f077034274c262d8d484e5aa68dd471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f073720cea2de6afedd9ae33af93a3ea5f077034274c262d8d484e5aa68dd471
SHA3-384 hash: c1a799d7a3814f7da09096bccd7dcb53580a01399c048a1c64f7baac8909a3a748a59239ae1456368f047f6802d90da2
SHA1 hash: aa2e791bc63483a89e6d4069d508283d1a91db00
MD5 hash: ff1ea4bdfbbd98c86d10ca47c0381005
humanhash: kitten-tennis-london-hotel
File name:Payment confirmation.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:195'894 bytes
First seen:2020-06-07 14:50:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:z8+M9WR+D12gIS9rB6/Lda1dD8CF8VvmUk3e3oxxvyj9GgZqeTbYkHzmUShX1gSt:z8+SEY3b9rMAbbWQO3799TbBmrXKgo6x
TLSH 3D141312EC9D5283277C8A85F2E65E38117A80B4577B70438DA926B2E3637C4DFED816
Reporter abuse_ch
Tags:CheetahKeylogger rar


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing28.jnb.host-h.net
Sending IP: 129.232.250.44
From: noreply <noreply@standardbank.co.za>
Subject: Payment confirmation
Attachment: Payment confirmation.rar (contains "Payment confirmation.exe")

CheetahKeylogger SMTP exfil server:
mail.aviner.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-07 14:52:05 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bzxedhkfxtk73ozvyz27e5d5jpqo4bue5gcmlmnjbhfvjun2ryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar f073720cea2de6afedd9ae33af93a3ea5f077034274c262d8d484e5aa68dd471

(this sample)

CheetahKeylogger

Executable exe d6de7175146f4b7d262b23adb6b14f3193fc755e10d80353a1a3cc9a164177e8

  
Dropping
MD5 0d93e6fe85bf79804990d42976ced9e0
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6de7175146f4b7d262b23adb6b14f3193fc755e10d80353a1a3cc9a164177e8

Comments