Extracted

• • Target
    SIWFT refTRF08463473 20201611.exe
  • Size 412KB
  • SHA256 5b4e102595fcfeb47ebf79618cd38e451c8543eb264d7faff586370023b3ccc0
  • MD5 9611b45fe4e49dc87f3869d87ca0ff36
  • SHA1 d3a25025afd82f5db880e42049db87f4f5203d7d
  • SHA512 1ee2976f9b02364e4dbbbd94dfe2f0eae3cb5a8975de809f9115df74acd284502a22f9666963e55842408184a3bd38550cc8dd481dd98dbe5c5450a8f997f7b8
  • MD5 SHA1 SHA512

  Score

  10^/10

  404keyloggerkeyloggerpersistencespywarestealer

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger

  • 404 Keylogger Main Executable

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2