MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb8eb3597fa3cf681ef95bb075c0d2975d60627e5da0e161e5b4ad1d6e2196d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb8eb3597fa3cf681ef95bb075c0d2975d60627e5da0e161e5b4ad1d6e2196d1
SHA3-384 hash: 77fc9d93bbffd8bc38ebc837dc4f0ffbd7f54d0795e2ce627c2df476881afbb0916cf67f7af4f231c0997428da6b4385
SHA1 hash: 5d3e1347dd5a5ba6b68ebf12084f09f77f572299
MD5 hash: 45cf48b70a9eb7afdcc1cf69f132287d
humanhash: two-yankee-helium-utah
File name:Order Quotation.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:194'114 bytes
First seen:2020-06-02 10:41:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:XJIi4qfvVSUULksLSxdA6UT4NnDDGfY0n0oj48Ln13dE5qtK8AlN5YWUtEzCnG2z:Ci4qfvVOka6gUDDGf/n0i/i5V+EzWGny
TLSH 77142312A3FF9B543FF58B6EFDC516280261052CDD7A9A1622CCDC9B2ED90BE21E0547
Reporter abuse_ch
Tags:CheetahKeylogger rar


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing11.cpt4.host-h.net
Sending IP: 197.189.249.68
From: Alicia Pretorius <27794915040@vodamail.co.za>
Subject: Re: Order
Attachment: Order Quotation.rar (contains "Order Quotation.exe")

CheetahKeylogger SMTP exfil server:
mail.aviner.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 03:44:00 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ohlgwl7uphwqhxzloyhlqgss5owayt6lwqocypfwswr23rbs3iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar fb8eb3597fa3cf681ef95bb075c0d2975d60627e5da0e161e5b4ad1d6e2196d1

(this sample)

CheetahKeylogger

Executable exe 8bf6d4a37e21f4d40654fe92c4326ffda085e4c77284c6a4d262163202d02c06

  
Dropping
MD5 d50f7276d323a4d6b9914d6f6d12ddc1
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8bf6d4a37e21f4d40654fe92c4326ffda085e4c77284c6a4d262163202d02c06

Comments