MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84c7583ce4e2ab51a3aed368da4911e2dea94822da6783ae9e108e230aba65a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84c7583ce4e2ab51a3aed368da4911e2dea94822da6783ae9e108e230aba65a6
SHA3-384 hash: b7ea42eed05ff689baed26d1c615052c32dc168ac636323c99411722d93feeba403cc7981f4a95e954891df92cbb2e76
SHA1 hash: bcd6e2034a22f122b060173922d250a3af0c6e33
MD5 hash: 5873a4f62d00c982a71089defb41835d
humanhash: tennessee-summer-mississippi-friend
File name:SIWFT refTRF08463473 20201611.r11
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:311'698 bytes
First seen:2020-11-16 09:37:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:n2nQ530WWgHJf4XD6OZnPvI1mTlrVZFLW8U+iuqe2X9A++TAlE:KyEWWgHJfeD7PxTFwOiC2NpuAlE
TLSH BB6423F71A0BFC13189BC1FB5049ED90CEC14BF80629792688E7E948D57DF9EA16194C
Reporter cocaman
Tags:404Keylogger r11 SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "Syam Sarath <syamsarath@pipoman.com>" (likely spoofed)
Received: "from pipoman.com (unknown [45.137.22.52]) "
Date: "16 Nov 2020 01:27:12 -0800"
Subject: "FW: SWIFT OF USD 53,000.00 (ref:TRF08463473)"
Attachment: "SIWFT refTRF08463473 20201611.r11"

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84c7583ce4e2ab51a3aed368da4911e2dea94822da6783ae9e108e230aba65a6/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 06:51:14 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qtdvqphe4kvvdi5o2nunusir4lpkssbc3jtyhlu6cchcgcv2mwta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

rar 84c7583ce4e2ab51a3aed368da4911e2dea94822da6783ae9e108e230aba65a6

(this sample)

404Keylogger

Executable exe 5b4e102595fcfeb47ebf79618cd38e451c8543eb264d7faff586370023b3ccc0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b4e102595fcfeb47ebf79618cd38e451c8543eb264d7faff586370023b3ccc0
  
Dropping
404Keylogger

Comments