404keylogger | 5f87d3d2de86061021fe30c5afe9d8e7154549036ba68200064658031c325eff

General

Target

5f87d3d2de86061021fe30c5afe9d8e7154549036ba68200064658031c325eff
Size

293KB
Sample

220521-bkkpfacab2
MD5

171d213647672f7097e266f992e944fc
SHA1

a525c95a7ea4fd28366c0685df2a18fc70705e74
SHA256

5f87d3d2de86061021fe30c5afe9d8e7154549036ba68200064658031c325eff
SHA512

59bcfcaf509032f54468d8df3b53e8a4305b2e6d28342a468583bff96da46e229e70991c1504ce3b35e6f39674bdc1ee3da70b204482541a267f8b420dd3823d

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
eJkG%KP9

Targets

- Target
  
  QUOTATION REQUEST.exe
- Size
  
  646KB
- MD5
  
  311102ca55b09ee930cfceca5e4c06da
- SHA1
  
  8fbe0182c4ae39acb97a23f16b5d758b4183ad4b
- SHA256
  
  4d10520e2b80ca42e98590435c36c5409a458d9a5bd0ad35b0f444d2ceb2626d
- SHA512
  
  0e812ff97fb68c2d635a681d12d21b997e81bb9a442bf1c375d7a459c1785bb355cb62227bb15672cd7146437d8f5274da8e348170c5570d247def339b8b73ee
Score

10^/10

404keylogger collection keylogger spyware stealer
- 404 Keylogger
  Information stealer and keylogger first seen in 2019.
  stealer keylogger 404keylogger
- 404 Keylogger Main Executable
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

404 Keylogger

404 Keylogger Main Executable

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2