Extracted

• • Target
    DHL DOCUMENTS TRACKING Nº 740977876.exe
  • Size 412KB
  • SHA256 a50379d0e18b56fd13df8ff29681fe54efa1ca4d313930064fb3a30ea6148f84
  • MD5 d71e248c768d9469470bc208d24696a3
  • SHA1 d2f3610b85ad924916def26f318eee2e2d58b285
  • SHA512 a7cbf0f1847244feb38ed71a5c031c5b4779311bc95b9931f8be619ceab6efd0f51d10f43eb8005f495b6e3e9fb07fce86b67e85a22d22d0b873e9865fe2fef8
  • MD5 SHA1 SHA512

  Score

  10^/10

  404keyloggercollectionkeyloggerpersistencestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2