MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8bb2fefcc34208fc3bd9bb1d8cbfff09fa6bacfa9e347c819f8ada48c214b41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8bb2fefcc34208fc3bd9bb1d8cbfff09fa6bacfa9e347c819f8ada48c214b41
SHA3-384 hash: 31439d5a08290d2aca64044a46e1b4a623b642be396a4f7201a14b8388b3780de8f2b85b81c14214da693bc7211bf075
SHA1 hash: 813e9c28c2cbe6d1e1ad83a4a9c5167a7e4bdc8b
MD5 hash: a5be69f501f045e4356b4ce5f1a2b732
humanhash: steak-fix-michigan-freddie
File name:swift copy 1f354972.r11
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:594'249 bytes
First seen:2020-12-30 08:37:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Lwi3FQq7xpw9ilPIVG2MNv6ioW2co7f5V8h6qOmbhWb9MS+uKU:sw7xpMZs2MMi/5Q5J9mbhA6S+u9
TLSH AEC423DE39198E2DB0985BEBE61282A1275451463F333F9C1DAE92236C32D5D37A0D3D
Reporter abuse_ch
Tags:r11


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rocketmail.com
Sending IP: 185.222.57.238
From: Mun Kee <jay_kee@rocketmail.com>
Attachment: swift copy 1f354972.r11 (contains "swift copy 1f354972.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8bb2fefcc34208fc3bd9bb1d8cbfff09fa6bacfa9e347c819f8ada48c214b41/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-12-30 08:38:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7c5s736mgqqi7q55toy5rs776cp2nowpvhrupsaz7cw2jdbbjnaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

rar f8bb2fefcc34208fc3bd9bb1d8cbfff09fa6bacfa9e347c819f8ada48c214b41

(this sample)

404Keylogger

Executable exe 5f76f22bc543897362a09bd6d101583fa0fe5bcaa02b3fd5f67b7c193a1b7ee5

  
Dropping
MD5 e65cdcca5fcc02b52bc18aadc3fe7e37
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f76f22bc543897362a09bd6d101583fa0fe5bcaa02b3fd5f67b7c193a1b7ee5

Comments