Overview

overview

10

Static

static

5

3b3359ee21...71.exe

windows7-x64

10

3b3359ee21...71.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b3359ee213d426db8bc231efc7cf36c6ec8585204b33107b0989c533963b971

  • Size

    1.6MB

  • Sample

    221125-lwpsmsce8z

  • MD5

    868fa8a88ce68d4824f08b304ea87b38

  • SHA1

    8286d300fe0a34104ca5210d4fe449ae92292dc7

  • SHA256

    3b3359ee213d426db8bc231efc7cf36c6ec8585204b33107b0989c533963b971

  • SHA512

    9d3de7f7810e67506e46ed901ed810c9f9189baa937ce910ce2597ad3eee914f473592d2c485f526fec059fdee076720303cac18d47411c7dfb80f664d193979

  • SSDEEP

    24576:Ltb20pkaCqT5TBWgNQ7a/CeTJkQouY8fmudCpDba+nG6RUA7gKFO/GcuHB86A:IVg5tQ7a/Celkd2gpx0A7gKFOUHG5

Score
10/10
cheetahkeyloggercollectionkeyloggerstealer

Malware Config

Targets

    • Target

      3b3359ee213d426db8bc231efc7cf36c6ec8585204b33107b0989c533963b971

    • Size

      1.6MB

    • MD5

      868fa8a88ce68d4824f08b304ea87b38

    • SHA1

      8286d300fe0a34104ca5210d4fe449ae92292dc7

    • SHA256

      3b3359ee213d426db8bc231efc7cf36c6ec8585204b33107b0989c533963b971

    • SHA512

      9d3de7f7810e67506e46ed901ed810c9f9189baa937ce910ce2597ad3eee914f473592d2c485f526fec059fdee076720303cac18d47411c7dfb80f664d193979

    • SSDEEP

      24576:Ltb20pkaCqT5TBWgNQ7a/CeTJkQouY8fmudCpDba+nG6RUA7gKFO/GcuHB86A:IVg5tQ7a/Celkd2gpx0A7gKFOUHG5

    Score
    10/10
    cheetahkeyloggercollectionkeyloggerstealer

    • Cheetah Keylogger

      Cheetah is a keylogger and info stealer first seen in March 2020.

      stealerkeyloggercheetahkeylogger

    • Cheetah Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks