Extracted

• • Target
    1371228,1372216.exe
  • Size 628KB
  • SHA256 f94835d0cfac325ba2187c8bec1f9e9cff185a087be4de42832731c3c7a51adc
  • MD5 1e562a3821639b53d1303a70c61bc057
  • SHA1 c283bae0afca9704bcfedb5948bc1010f09a816d
  • SHA512 0d0591d7f1e4e7cf6e5fdf74a4fb79a147a36051da5f8b4dbdc906153f9b80045e08bf31647b7886a3a9728eeb67b699f4b533ba445aba046024706e20bb1cab
  • MD5 SHA1 SHA512

  Score

  10^/10

  404keyloggercollectionkeyloggerspywarestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2