Extracted

• • Target
    Payment confirmation.exe
  • Size 316KB
  • SHA256 432feb3811e7e4993eedfdea5735d5790ec0dd0a660a4940841969ffee54194c
  • MD5 09e1f9b49bb6d33d6b88518c9449fde1
  • SHA1 accd9fdf8c6166e8e887e3bfc92c4cf3cb91ca46
  • SHA512 d13a7366975ad9ff8a61eaac76d7bf3318b3966341af91b8a7c75d31909ae98e1a8c9e83553f3ffa43a5c54eae220941c9f1dc64607ea5c5320906d5510789e1
  • MD5 SHA1 SHA512

  Score

  10^/10

  cheetahkeyloggercollectionkeyloggerspywarestealer

  • Cheetah Keylogger

    Cheetah is a keylogger and info stealer first seen in March 2020.

    stealerkeyloggercheetahkeylogger

  • Cheetah Keylogger Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2