Extracted

• • Target
    c51c39d848c20c850cfb0d3d46e3448d_JaffaCakes118
  • Size 334KB
  • SHA256 bd704ad7133204a735457cb398b9eb5fd7662050ae1fcd379674cc4b06a70665
  • MD5 c51c39d848c20c850cfb0d3d46e3448d
  • SHA1 9b4e635287a558f208c26e060a512d8a484ddee3
  • SHA512 ec5b7bf4257cfe5fe85c08d272a8e40851d18e2b315b80be33396d4de16e96d4ae619b5f567479df6099242bbc08554cb02f32a86552e10056172044af930a66
  • SSDEEP 6144:tXouwY91LBWi9GhXGWB80yPQzmAiWeZAykHLzExTCLNmTYY8YbsKOSgJ/wWGw/K1:No091L4i9GhXGWB80yPQzmAiWeZAykH+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  404keyloggercollectioncredential_accessdiscoverykeyloggerpersistencestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • 404Keylogger family

    404keylogger

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2