MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 275bbcb68e33c663127f056fcf9d69330bed4510ce97ff8977bef6caca29042a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 275bbcb68e33c663127f056fcf9d69330bed4510ce97ff8977bef6caca29042a
SHA3-384 hash: 3d6953658acadf255712f668fdcae181dc92d9c62644d276fb978a806421caf049605fce605f1e721f8efae020d2e37e
SHA1 hash: f4d0b699e38bdcbe68b295b512a7d179ae2dd8a4
MD5 hash: b0fea5bdba3440bf066b5e3b76b711c3
humanhash: jupiter-avocado-nineteen-east
File name:SKM_658e2002814130.exe
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:763'904 bytes
First seen:2020-04-30 08:10:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 556c6a7e5f749bf800bb7913c54276f4 (10 x AgentTesla, 8 x Loki, 4 x RemcosRAT)
ssdeep 12288:9JtGIf+pco+KipZHb9GNTU6Bd1K/+71UWS3YcC9qndBFEks:9LdfZhpFb6TU2uE19S3YJ9qnHU
Threatray 1'839 similar samples on MalwareBazaar
TLSH DAF4AF26F1D04837C1632A3C9D5B5764A8367E103E29E84B6BF82D4C5FF8691763A2D3
Reporter abuse_ch
Tags:404Keylogger ESP exe geo


Avatar
abuse_ch
Malspam distributing 404Keylogger:

HELO: virtus-technology.com
Sending IP: 45.153.241.153
From: Gerente financiero <natthakarn@virtus-technology.com>
Subject: Rv: Pago Pendiente
Attachment: SKM_658e2002814130.arj (contains "SKM_658e2002814130.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 19:40:03 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5n3znuogpdgget7avx47hljgmf62riqz2l77clxx33mvsrjaqva._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
01e932fe6a5240f2a1f05190b4cf64247842b1a96d858ba98c5f515234103706
404Keylogger
108de1bd47a6c60e2ba5ec4d5b1e47f42bd4e6048fc09d940c441e26f8ee45dc
404Keylogger
121cba7566201217f8725044bc4e51283b873305c5e84b9e1623313cefa5fe4b
404Keylogger
482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10
404Keylogger
5c2ea777da33a621b23492ec92638ae11c24dd7f77e9607277d77a7a02f5ee5b
404Keylogger
6645ca72c1da8e6325dc17645413624742d223df8ca65c6a178ff600bc00cb52
404Keylogger
7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e
404Keylogger
8243c8a72e7a2021b4d956f5dafc19ded0162e9eb99f158f8da83660ea9368b5
404Keylogger
c82e474e76b1641ab73aafe25ebe9f509a27997a3d4e76015c5eabca15acdc63
404Keylogger
eacb842bfb2638dad0dfc194ecf323a019780a3ab3be7f2f21e2a0d5726156f2
404Keylogger
+ 1'829 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

arj 4bfef8f8f5b1544f75d4a021d5ccd9d8063cb860b8ba0bed6e08c5b0fc844ea2

404Keylogger

Executable exe 275bbcb68e33c663127f056fcf9d69330bed4510ce97ff8977bef6caca29042a

(this sample)

  
Dropped by
MD5 95f66bd4e45ad2a3059605007e291dc1
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4bfef8f8f5b1544f75d4a021d5ccd9d8063cb860b8ba0bed6e08c5b0fc844ea2

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments