Overview

overview

10

Static

static

UIF Covid-19.exe

windows7_x64

10

UIF Covid-19.exe

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    d1acea1398cdd89532e97a2d897aa213ce4179d84d87ae0707696d764b925c38
  • Size 209KB
  • Sample220205-lqds7aaah2
  • SHA256 d1acea1398cdd89532e97a2d897aa213ce4179d84d87ae0707696d764b925c38
  • MD5 SHA1 SHA512
Score
10/10
cheetahkeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.baconplumbing.co.za
  • Port

    587
  • Username

    [email protected]
  • Password

    Andrew@1652

Targets

    • Target
      UIF Covid-19.exe
    • Size 358KB
    • SHA256 7c66bdf5e60c828d8033218f9807b954e26046817acda2a8235a5b3bc68c5277
    • MD5 SHA1 SHA512
    Score
    10/10
    cheetahkeyloggercollectionkeyloggerstealer

    • Cheetah Keylogger

      Cheetah is a keylogger and info stealer first seen in March 2020.

      stealerkeyloggercheetahkeylogger

    • Cheetah Keylogger Payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks