Extracted

• • Target

    80ffd81d3515ad6c242ee9c7a89570b3dc64554c7374a618194f97f4ead977a0

  • Size

    277KB

  • MD5

    42c46a822f403a6be70133ba356b917a

  • SHA1

    0e49ed7754d124cdea0986a1034c5ec7ba1b7696

  • SHA256

    80ffd81d3515ad6c242ee9c7a89570b3dc64554c7374a618194f97f4ead977a0

  • SHA512

    3f4683cda00973e6f97daecd54a558f36edc893c35b2bf7ca3df5d5090a8f942ae717ef80d17530137883151fbc88cb75cda9ec3d27621929ed885a6edd3dd1b

  Score

  10^/10

  404keyloggercollectionkeyloggerpersistencestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2