Extracted

• • Target

    Payment Notification.exe

  • Size

    381KB

  • MD5

    673a1dd42a4ce1a314a1db4dcbf09a81

  • SHA1

    2fdb26d92e25c38c6300123278cbcea3be6a0ecc

  • SHA256

    684aa4d9c333d3ea5db101d239673a76f22e06ae5237ae24b00e43c55cb3b3ae

  • SHA512

    9be66fa1b076700972797c273bce0d14594fc3cc58728e0ca5552138c9dac04152470ae70d44a7c9c6dbf2b672143085134e14a9f7c6c54cce88aa2715ad6201

  Score

  10^/10

  cheetahkeyloggeragilenetcollectionkeyloggerstealer

  • Cheetah Keylogger

    Cheetah is a keylogger and info stealer first seen in March 2020.

    stealerkeyloggercheetahkeylogger

  • Cheetah Keylogger Payload

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2