Overview

overview

10

Static

static

Purchase Order.exe

windows7_x64

10

Purchase Order.exe

windows10-2004_x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    771750971a05a00827d90831fd751117160cfb014f8171c9999b13631439deff
  • Size 255KB
  • Sample220521-c72f5saccj
  • SHA256 771750971a05a00827d90831fd751117160cfb014f8171c9999b13631439deff
  • MD5 SHA1 SHA512
Score
10/10
cheetahkeyloggeragilenetcollectionkeyloggerstealer

Malware Config

Targets

    • Target
      Purchase Order.exe
    • Size 399KB
    • SHA256 0126bb5bedfa1d8a433bfa4bf885c9a86d0d98630254c7293d70e766f372432e
    • MD5 SHA1 SHA512
    Score
    10/10
    cheetahkeyloggeragilenetcollectionkeyloggerstealer

    • Cheetah Keylogger

      Cheetah is a keylogger and info stealer first seen in March 2020.

      stealerkeyloggercheetahkeylogger

    • Cheetah Keylogger Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks