MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 358f27d29797fdd183f88b02fb2cc8f322a7ccbdb32e927fc14f22004a63b72f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CheetahKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 358f27d29797fdd183f88b02fb2cc8f322a7ccbdb32e927fc14f22004a63b72f
SHA3-384 hash: 52fc332d6099f3a2979bdb6f0b211a9a2dca703185bbe84cb9b60f18d596a4afca30acc4f51b20e67fc7aafdde030c29
SHA1 hash: afb6fd400e6cbd4a398479a1e35718a795e3c17f
MD5 hash: d0de53b48ebea1bfc7b20c85abea4426
humanhash: india-california-mars-butter
File name:Payment confirmation.rar
Download: download sample
Signature CheetahKeylogger
Create hunting rule
File size:146'612 bytes
First seen:2020-07-03 06:13:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:ZQlLEW7NpGek3lj6hnLgiI1txZmxfT9BPfH4OQIvQHDJJNuMMJHIA2rVZT:ZQlPqek3Jm96w3BPfoIvQHDeBoZZT
TLSH 30E312DAF31D499E4B35444CDF2B09FD4212488569390F66ECC0DE4CB4BCAE685ECAA9
Reporter abuse_ch
Tags:CheetahKeylogger rar


Avatar
abuse_ch
Malspam distributing CheetahKeylogger:

HELO: outgoing21.jnb.host-h.net
Sending IP: 129.232.250.52
From: Standard Bank <noreply@standardbank.co.za>
Subject: Payment confirmation
Attachment: Payment confirmation.rar (contains "Payment confirmation.exe")

CheetahKeylogger SMTP exfil server:
mail.aviner.co.za

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/358f27d29797fdd183f88b02fb2cc8f322a7ccbdb32e927fc14f22004a63b72f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:15:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwhspuuxs765da7yrmbpwlgi6mrkptf5wmxje76bj4raastdw4xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CheetahKeylogger

rar 358f27d29797fdd183f88b02fb2cc8f322a7ccbdb32e927fc14f22004a63b72f

(this sample)

CheetahKeylogger

Executable exe 432feb3811e7e4993eedfdea5735d5790ec0dd0a660a4940841969ffee54194c

  
Dropping
MD5 09e1f9b49bb6d33d6b88518c9449fde1
  
Dropping
CheetahKeylogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 432feb3811e7e4993eedfdea5735d5790ec0dd0a660a4940841969ffee54194c

Comments