MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 946200f42fe267c47b2e0983a1d2e1249b78433412f4a0874eee89d985b76553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

404Keylogger

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	946200f42fe267c47b2e0983a1d2e1249b78433412f4a0874eee89d985b76553
SHA3-384 hash:	cb7b15f02144d89d0a2306eb25ae569c181f5eefa54d87c9bf7ac6050798ac0d48d9f6e6ba180456a23fec488b8c9ed4
SHA1 hash:	455f26db06f103c17cb598aa2915e0a3603500b9
MD5 hash:	d5352c6bb63c982f9e28e53f2770273d
humanhash:	juliet-jersey-golf-white
File name:	PACKING LIST UPDATE 45201750254.exe
Download:	download sample
Signature	404Keylogger Create hunting rule
File size:	708'608 bytes
First seen:	2020-08-03 14:14:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	419fbe6e075aa65af76659d0d420ea2c (6 x AgentTesla, 6 x MassLogger, 1 x Pony)
ssdeep	12288:qz7VdBti8MLJ7B8xsYP2ExVZpL1EHvXUd+be2K5y9xhmVrHQM:qzZTtiz78xsYLZpm8UqvziM
Threatray	2'455 similar samples on MalwareBazaar
TLSH	D7E48D23B2D04437C1732A3C9F1BAFB5983ABE11392899466BF75C4C8F396513936297
Reporter	abuse_ch
Tags:	404Keylogger exe

abuse_ch

Malspam distributing 404Keylogger:

HELO: gmail.com
Sending IP: 185.222.57.207
From: Nam Nguyễn Trọng <namnt16590@gmail.com>
Subject: Lại: danh sách kiểm TRA ST INQ 1119
Attachment: PACKING LIST UPDATE 45201750254.gz (contains "PACKING LIST UPDATE 45201750254.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Sanesecurity.Rogue.0hr.20200803-1006.UNOFFICIAL

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.Variant.Strictor.247893.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Sending a custom TCP request

Sending a UDP request

Deleting a recently created file

Result

Threat name:

404Keylogger AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/408111

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected 404Keylogger

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/946200f42fe267c47b2e0983a1d2e1249b78433412f4a0874eee89d985b76553/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-03 08:01:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=srrab5bp4jt4i6zobgb2duxbesnxqqzucl2kbb2o52e5tbnxmvjq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

404Keylogger

518f61b23eb64a58b3bc75b881de46dbbf852a3f77ae3677d5763caeb2ad913c

404Keylogger

709b84654b39c5359744acd7549de90b83b697f2d018becf42e77d36ad7fab90

404Keylogger

731d6bd52db80b3c422dc2e72e9c17adf0018fe1a392e67d28f642d96c02411e

404Keylogger

9026e9b714998846a26087ed7f5a276b1399204a1e34d469571a7301ce720931

404Keylogger

af57927aac1c53cbb2fa38eceeb02f2739a44433f9dd0328e22e69da3239cf39

404Keylogger

b09caba2fbb0d66ee3451e31471cd2b3daabef15c16b16b300f92cb00f7482d1

404Keylogger

b4ddc58acc408b2ba14056f04e2a989f229e537dc7132a48250b3565ef82ca09

404Keylogger

d8689dd42505b5642a74074a5b1b37f8cd721c5e6423cf63f1fe80fe180f839a

404Keylogger

f94835d0cfac325ba2187c8bec1f9e9cff185a087be4de42832731c3c7a51adc

404Keylogger

+ 2'445 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

upx spyware

Link:

https://tria.ge/reports/200803-y18dvh4z5n/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Strictor

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/946200f42fe267c47b2e0983a1d2e1249b78433412f4a0874eee89d985b76553

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184