Extracted

• • Target

    f17184ba673aa0c58283ca4466d04864_JaffaCakes118

  • Size

    1.7MB

  • MD5

    f17184ba673aa0c58283ca4466d04864

  • SHA1

    f51d8aa5678567b60549beb549849d2c6057caa4

  • SHA256

    f629522071fa7ae8e8b64c33a5b5bd243e45cae769ec13a8536f1abc1ab2ca84

  • SHA512

    5933fcd94962ecb828f7b393c05f139c568e62d7bc01ccc4e5392baf43ab0bf49e880f6ff9b06b0cb3ac82846ac498be1941604a8860de50af44201f0e040a1f

  • SSDEEP

    24576:Etb20pkaCqT5TBWgNQ7abvRXzpS/Oczx+7qTc/i8olSN4dKUwL6A:tVg5tQ7abv3S/ZzE9/i8olSqe5

  Score

  10^/10

  404keyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2