MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42ab597768abc4bf3851df6416b47d6b1931f72bfb46a93eaba72fb71419bf09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhoenixKeylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42ab597768abc4bf3851df6416b47d6b1931f72bfb46a93eaba72fb71419bf09
SHA3-384 hash: a7f071b8cb6f90f1f884c92c6e2ec075f26e3ba80d5c1021d3a411025f2e1478399a0f9c0f98734f3fcfddb406af8200
SHA1 hash: 57989840d203f95275a28dd9c5b317d226bee87a
MD5 hash: 318575211a76bf1d63d509993663f86f
humanhash: magazine-iowa-thirteen-dakota
File name:DHL Delivery Reciept.arj
Download: download sample
Signature PhoenixKeylogger
Create hunting rule
File size:308'549 bytes
First seen:2020-08-19 13:39:11 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:xCz/Dhl1I65ODeokhu8z0DPl10OIpkFBbwm2tj/IbiUSJIaZYPkJ6:Q1I65Oy28z4PlKlpkzIhIbeIo0Q6
TLSH 5E6423B8ACECE3389509568212EC37F456D1A7BF10E06F184DD4B41A549CB7B0B9FE62
Reporter abuse_ch
Tags:arj DHL PhoenixKeylogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: xzn0.722.metalvxini.ga
Sending IP: 178.62.200.135
From: DHL QUERY <dhaquery@dhl.com>
Subject: DHL: Urgent:Delivery Receipt Wrong delivery Address Report
Attachment: DHL Delivery Reciept.arj (contains "DHL Delivery Reciept.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42ab597768abc4bf3851df6416b47d6b1931f72bfb46a93eaba72fb71419bf09/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 13:41:07 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ikvvs53ivpcl6ocr35sbnnd5nmmtd5zl7ndkspvlu4x3ofazx4eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/42ab597768abc4bf3851df6416b47d6b1931f72bfb46a93eaba72fb71419bf09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PhoenixKeylogger

arj 42ab597768abc4bf3851df6416b47d6b1931f72bfb46a93eaba72fb71419bf09

(this sample)

PhoenixKeylogger

Executable exe b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87

  
Dropping
MD5 da1578d55d9f171e52ef19ea2c25aff2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87

Comments