Extracted

• • Target
    c5e86a90204e3b5615935a24437095c346af4fff94ab1029836f0c2b022d1a21
  • Size 272KB
  • SHA256 c5e86a90204e3b5615935a24437095c346af4fff94ab1029836f0c2b022d1a21
  • MD5 1df80d6fde23659617f571945d4016ea
  • SHA1 9f9f3141c7b154e82bca244003c64faf7e3e7271
  • SHA512 2b9711bbbd216adf980ab03f0ca2b241db2ad5b529ceb6b1b647f133f12c27c0eee4908734a5d659c8a167d1d2ee2ec7cdba70b3c0d1bbcc63f7d3222cdb7bea
  • MD5 SHA1 SHA512

  Score

  10^/10

  404keyloggercollectionkeyloggerpersistencestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2