Overview

overview

10

Static

static

5

14d3e00e80...18.exe

windows7-x64

10

14d3e00e80...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14d3e00e8027db78a81490e692299712_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240504-2rqgdaeb41

  • MD5

    14d3e00e8027db78a81490e692299712

  • SHA1

    d6dcc19c0ab0d43ed41af980700acc655a4a8888

  • SHA256

    b95cc2d6e179471e7c09c2033124a1a7fe93466269da002aa8b315d398fbea14

  • SHA512

    ad80449612cbb62e250e0ae2f8681e5c3a23a8437b9598b412f4f01a123cc3088a8d6580fea75c9785d16bec8ba80bc0563adc3047fe4860eb64b9981a5bf36f

  • SSDEEP

    24576:+tb20pkaCqT5TBWgNQ7aEAu0R8/YQ9W783TFtazDkkih76A:rVg5tQ7aEaWt9pckkU5

Score
10/10
404keyloggercollectionkeyloggerstealer

Malware Config

Targets

    • Target

      14d3e00e8027db78a81490e692299712_JaffaCakes118

    • Size

      1.5MB

    • MD5

      14d3e00e8027db78a81490e692299712

    • SHA1

      d6dcc19c0ab0d43ed41af980700acc655a4a8888

    • SHA256

      b95cc2d6e179471e7c09c2033124a1a7fe93466269da002aa8b315d398fbea14

    • SHA512

      ad80449612cbb62e250e0ae2f8681e5c3a23a8437b9598b412f4f01a123cc3088a8d6580fea75c9785d16bec8ba80bc0563adc3047fe4860eb64b9981a5bf36f

    • SSDEEP

      24576:+tb20pkaCqT5TBWgNQ7aEAu0R8/YQ9W783TFtazDkkih76A:rVg5tQ7aEaWt9pckkU5

    Score
    10/10
    404keyloggercollectionkeyloggerstealer

    • 404 Keylogger

      Information stealer and keylogger first seen in 2019.

      stealerkeylogger404keylogger

    • 404 Keylogger Main Executable

    • Drops startup file

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks