Extracted

• • Target

    d70b1d7ebfde15715b3e63d8b4cf75c9025de1e3744d83c78278d7e939d459de

  • Size

    347KB

  • MD5

    0b7b2acd93a784e3af07bd3acaec2e97

  • SHA1

    069c15a1913cd506ffc306a14075e7dd28a3d122

  • SHA256

    d70b1d7ebfde15715b3e63d8b4cf75c9025de1e3744d83c78278d7e939d459de

  • SHA512

    aecdfc30af77e6500c0fc5951a5bb0d476d7e932e77b3303044b26a99e6d0b328db72623e076174d6a6d56dfe792ef43d71e145d73500fc39842ef0e061e9807

  Score

  10^/10

  cheetahkeyloggeragilenetcollectionkeyloggerstealer

  • Cheetah Keylogger

    Cheetah is a keylogger and info stealer first seen in March 2020.

    stealerkeyloggercheetahkeylogger

  • Cheetah Keylogger Payload

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2