Extracted

• • Target

    0bec6fa8f995272581d8663786efb3b8_JaffaCakes118

  • Size

    1.2MB

  • MD5

    0bec6fa8f995272581d8663786efb3b8

  • SHA1

    605b6865d43ac4c32f4b3f3f4534d832509819f5

  • SHA256

    46ff34ff0185ef7fa03e8e3578623ddac35e6c622fdc30f0c6501ce0467e8de0

  • SHA512

    e539b510a8e62ee632dddeaa1303317185377ec8ecd269201d9999b4f02f1700b3084c3d7bce0548da1030b99dfdf26ec05c5b5f0c9086cdc0e4b960f4672a8b

  • SSDEEP

    24576:qu6J33O0c+JY5UZ+XC0kGso6Fai/om/oG7a88P5r1YWY:cu0c++OCvkGs9Fai/X/BW8YlY

  Score

  10^/10

  404keyloggercollectionkeyloggerstealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2