MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56671421295bb65ac0572a24d6638c072465d4061eb7f1e8ad9fdc3c2967913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f56671421295bb65ac0572a24d6638c072465d4061eb7f1e8ad9fdc3c2967913
SHA3-384 hash: 4f955fc59d03bdeefde8a283a2afce9538525537ad0c1759a4b2ed119cfef18f525873f900908974ad336779c0044455
SHA1 hash: ed68d8a3cb960a6214b20a538317c7932ac796a9
MD5 hash: 50c1a3d982588d77b38550872e6c42c3
humanhash: wolfram-oxygen-seven-georgia
File name:Zcgogex.exe
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:791'042 bytes
First seen:2020-05-15 07:33:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash faf07f402117881881965d6439a79e75 (1 x RemcosRAT, 1 x 404Keylogger)
ssdeep 12288:Z7qvEaK6j5vEwH4qz/83d8/Q7U+yN1pnxAExf9wqvbciYHXxXcw8FCvi:ZkEIp7z8f7jyrlxxFJPYSz
Threatray 828 similar samples on MalwareBazaar
TLSH 1DF4AE22F3F05432F166563C9C1B967CAC36BE223E2499467BE56D4C7F39350742A2A3
Reporter abuse_ch
Tags:404Keylogger exe


Avatar
abuse_ch
Malspam distributing 404Keylogger:

HELO: gsa-data.org
Sending IP: 45.249.91.173
From: Store<info@gsa-data.org>
Subject: Fw: Payment
Attachment: Reciept2020.rar (contains "Zcgogex.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 06:12:04 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vthcqqssw5wllafokre2zryybzemxkamhvx6huk3h64hquwpejq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
00481f6d6a28c6792dc0ddeb8cf053ec065be3ebebd70137dc51dbbd1f4c1898
404Keylogger
0a70b0923bbeabb1a48caaf2a3e37d81def85aeda662746bb782a4de7fecdb4a
404Keylogger
2392838d6d73a8d9675bbce1e1e5b6e81900a9fc0c2bbd49bd432095b5eafcb2
404Keylogger
244e2f212245708bd757b50107c8d221e842a683c258f16b744be653fde53c73
404Keylogger
54519fe3bb2beec228d65ef66bb64cb19beb8bd0f6cc7d973b69137950f5bc6f
404Keylogger
8ad9862548bf4d19b6e8efc18a0a54a359cc4f11a7f4bfac1a3029b853fa6e0e
404Keylogger
aa1de2e65be7572bdcc37b22c2c2f9be31ee5920d41174bfd18b2c2b7fabc6b9
404Keylogger
d015c42aeec1560eb2cf33b77fab18293a23cf61a7621746bc923a9ad4cc64dd
404Keylogger
d0b771681ca1f486be3efc349653e38e750a626bea06ebcb1d634431fd1e8dda
404Keylogger
e643abc845abbeff62e11e9b5e3ca4c3367a3aad01d5d4733c34c965cad9dc0c
404Keylogger
+ 818 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-sqtgy86cle/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Codoso_Gh0st_1
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:Codoso_Gh0st_2
Create hunting rule
Author:Florian Roth
Description:Detects Codoso APT Gh0st Malware
Reference:https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_ave_maria_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

rar da4e7c4cfcaf3e2d4718f9f9bcfac9cb14c0fe404f9985484ca5a081e8344d74

404Keylogger

Executable exe f56671421295bb65ac0572a24d6638c072465d4061eb7f1e8ad9fdc3c2967913

(this sample)

  
Dropped by
MD5 4e6debb92edbe3fe2f5de69fad5a4cac
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 da4e7c4cfcaf3e2d4718f9f9bcfac9cb14c0fe404f9985484ca5a081e8344d74

Comments