Overview

overview

10

Static

static

6f114eb67f...3e.exe

windows7-x64

10

6f114eb67f...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f114eb67f2957867f449185493502e761dac3bf42afec7fcea2a1f49135b83e

  • Size

    291KB

  • Sample

    220725-fshbhafgh7

  • MD5

    471c1bfe49a45efdbd925956ef79b18a

  • SHA1

    4891a1b912848c5990ceabd7cfb815df4d7ee6ab

  • SHA256

    6f114eb67f2957867f449185493502e761dac3bf42afec7fcea2a1f49135b83e

  • SHA512

    58db68688cd70eb7d4646d6f31b618525b3c5bb282955d530ab023e18ebefd0d0f6be397f0c0866ae7d8c93e30c57a8ea6ffd7f60ccb94c470f13babae0100c3

Score
10/10
404keyloggercollectionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      6f114eb67f2957867f449185493502e761dac3bf42afec7fcea2a1f49135b83e

    • Size

      291KB

    • MD5

      471c1bfe49a45efdbd925956ef79b18a

    • SHA1

      4891a1b912848c5990ceabd7cfb815df4d7ee6ab

    • SHA256

      6f114eb67f2957867f449185493502e761dac3bf42afec7fcea2a1f49135b83e

    • SHA512

      58db68688cd70eb7d4646d6f31b618525b3c5bb282955d530ab023e18ebefd0d0f6be397f0c0866ae7d8c93e30c57a8ea6ffd7f60ccb94c470f13babae0100c3

    Score
    10/10
    404keyloggercollectionkeyloggerpersistencestealer

    • 404 Keylogger

      Information stealer and keylogger first seen in 2019.

      stealerkeylogger404keylogger

    • 404 Keylogger Main Executable

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks