Static

static

9855bb648d...8b.exe

windows7_x64

10

9855bb648d...8b.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9855bb648dd60519f037e2f8fa4c8c8b.exe
  • Size 332KB
  • Sample201109-27358bkcg6
  • SHA256 bf4c1b1e3d2c229a1238bffcf18e4b49e875f6bbe92bca5d79ab2a4ef27d0ae2
  • MD5 SHA1 SHA512
Score
10/10
cheetahkeyloggeragilenetkeyloggerstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.aviner.co.za
  • Port

    587
  • Username

    [email protected]
  • Password

    NoLimits@

Targets

    • Target
      9855bb648dd60519f037e2f8fa4c8c8b.exe
    • Size 332KB
    • SHA256 bf4c1b1e3d2c229a1238bffcf18e4b49e875f6bbe92bca5d79ab2a4ef27d0ae2
    • MD5 SHA1 SHA512
    Score
    10/10
    cheetahkeyloggeragilenetkeyloggerstealer

    • Cheetah Keylogger

      Cheetah is a keylogger and info stealer first seen in March 2020.

      stealerkeyloggercheetahkeylogger

    • Cheetah Keylogger Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks