Overview

overview

10

Static

static

UIF Covid-19.exe

windows7_x64

10

UIF Covid-19.exe

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1acea1398cdd89532e97a2d897aa213ce4179d84d87ae0707696d764b925c38

  • Size

    209KB

  • Sample

    220205-lqds7aaah2

  • MD5

    7cd820a8ab5b41ca93b664784c2e483f

  • SHA1

    bb41cc73acc6aca662805f95252971859df7c10e

  • SHA256

    d1acea1398cdd89532e97a2d897aa213ce4179d84d87ae0707696d764b925c38

  • SHA512

    4f3c0030514ea1b51394514f0c77229d178775b11006eb2ee9dc48b290b88760683f6d8f17da238d3a28d3ed3384ebb7ce1b0bf24f97f401b2bbc0fe7aadb194

Score
10/10
cheetahkeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.baconplumbing.co.za
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Andrew@1652

Targets

    • Target

      UIF Covid-19.exe

    • Size

      358KB

    • MD5

      3601ca92dbd87d046273d2c6aca6e7a6

    • SHA1

      a37cf982bf9d242601124346d17eafea404d6b07

    • SHA256

      7c66bdf5e60c828d8033218f9807b954e26046817acda2a8235a5b3bc68c5277

    • SHA512

      9a0e39178a2c248a9470d6899e9fe9528531423d479d6571dd8380d1ed3f04aac596436bdcec23aa686bafba54459c889ffcc6af08d366a9d8adf442f040ba1f

    Score
    10/10
    cheetahkeyloggercollectionkeyloggerstealer

    • Cheetah Keylogger

      Cheetah is a keylogger and info stealer first seen in March 2020.

      stealerkeyloggercheetahkeylogger

    • Cheetah Keylogger Payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks