MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

404Keylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10
SHA3-384 hash:	7acef3a7f5e316b666d352a9b61b940e16fa7145a99f66c7a325d22aca4825adcb289f2d6a42c2a921983afce21ac19e
SHA1 hash:	b2038907c6ec79a065eb4eeb8df8f699ac8a9045
MD5 hash:	845848b0f4eace48a4ed4946c2eb0f62
humanhash:	carpet-sodium-charlie-timing
File name:	HI2003-02.exe
Download:	download sample
Signature	404Keylogger Create hunting rule
File size:	576'000 bytes
First seen:	2020-08-05 07:24:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	89f9603ab119f487b36c91fab25c064e (8 x AgentTesla, 4 x Loki, 2 x MassLogger)
ssdeep	12288:y9N5xdEzBMwNXyseVY06gkdo7AL8Mj0a2Y/vH:SnczvIYl83a2WH
Threatray	2'434 similar samples on MalwareBazaar
TLSH	C3C48D22E3F1C933C167273DCD2B5778982ABE5129E85846AFE81D4C5F397813929393
Reporter	abuse_ch
Tags:	404Keylogger exe

abuse_ch

Malspam distributing 404Keylogger:

From: sirlopu.hector@grupoproyectos.com.pe
Subject: Request Information Form Enquiry
Attachment: HI2003-02.arj (contains "HI2003-02.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Phoenix

Link:

https://www.capesandbox.com/analysis/39087/

Detection(s):

SecuriteInfo.com.Win32.Herz.B.23927.UNOFFICIAL

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Sending a UDP request

Sending a custom TCP request

Deleting a recently created file

Result

Threat name:

404Keylogger AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/410369

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected 404Keylogger

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-05 00:53:14 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jawinmxggi5z2qnqnevpc4fmkjaztdavxo2in3jlvmxgbjuedqia._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

404Keylogger

121cba7566201217f8725044bc4e51283b873305c5e84b9e1623313cefa5fe4b

404Keylogger

652c0bdfcb3143e7e53653a820dcf1a3528afb60a09ae7817ef20e6094d97596

404Keylogger

65a226dbf2cb9d30ad397117199260d3b8989e99c01de03a0d4f8eb0622794fc

404Keylogger

7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e

404Keylogger

8243c8a72e7a2021b4d956f5dafc19ded0162e9eb99f158f8da83660ea9368b5

404Keylogger

8b90d7894eecdabe437c469f62ca2cf8cff3fed04fc0e01287bfb2bde6454ee1

404Keylogger

8f746ab02591cecc45226d28bf483dff6616f697c1d79f8d1daddd5e8ba1d764

404Keylogger

b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87

404Keylogger

eacb842bfb2638dad0dfc194ecf323a019780a3ab3be7f2f21e2a0d5726156f2

404Keylogger

+ 2'424 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

upx spyware

Link:

https://tria.ge/reports/200805-nfj4ztr6lx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Cryptor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184