MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

404Keylogger

Vendor detections: 9

Intelligence 9 IOCs YARA 9 File information Comments

SHA256 hash:	48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d
SHA3-384 hash:	81eb27745be606392c89d5a8ba38b5ba7d28e4af714702266307382d376144cb9279dcf4a4e50c0bf20ff5ce20910f47
SHA1 hash:	566d67116a5195f15c85810186894e457a66b647
MD5 hash:	a931a16b753c3a6bf65ab2fd203d8216
humanhash:	zulu-michigan-fifteen-jig
File name:	Purchase Order NÂ° EQ 0010-0121.exe
Download:	download sample
Signature	404Keylogger Create hunting rule
File size:	882'176 bytes
First seen:	2021-01-11 08:52:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:TRJO0GPbBKVqucZYWoy9oUfhyOHEghdDE6tylFeVYcSAgdAdPSUbJkE5rQw/mPD:TnfGAVMSUfLEyJBtyOT8iDbJkE5Ub
Threatray	1 similar samples on MalwareBazaar
TLSH	E0150152263A7B22D83A03B70479071057FAF64AE663CA7EBDE0B0DC1957B0546F2D36
Reporter	abuse_ch
Tags:	404Keylogger exe

abuse_ch

Malspam distributing 404Keylogger:

HELO: delcot.net
Sending IP: 45.153.240.255
From: Marketing / Sales <ahsan.habib@delcot.net>
Subject: PURCHASE ORDER N° EQ 0010-0121
Attachment: Purchase Order N EQ 0010-0121.arj (contains "Purchase Order NÂ° EQ 0010-0121.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Purchase Order NÂ° EQ 0010-0121.exe

Verdict:

Malicious activity

Analysis date:

2021-01-11 08:53:11 UTC

Tags:

evasion trojan stealer

Link:

https://app.any.run/tasks/2835e313-704c-4284-985c-725d90397fbe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/111243/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Connection attempt

Creating a process from a recently created file

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Setting a global event handler for the keyboard

Enabling autorun by creating a file

Result

Threat name:

404Keylogger AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/577728

Signature

.NET source code references suspicious native API functions

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected 404Keylogger

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-01-11 08:53:06 UTC

AV detection:

13 of 46 (28.26%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jc6uphoxquzlbofaiokohpgj2bjuqta3iocazraoiu4vfopycyoq._file

Verdict:

unknown

404Keylogger

Result

Malware family:

404keylogger

Score:

10/10

Tags:

family:404keylogger keylogger spyware stealer

Link:

https://tria.ge/reports/210111-knygmy1kd6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

404 Keylogger

404 Keylogger Main Executable

Unpacked files

SH256 hash:

48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d

MD5 hash:

a931a16b753c3a6bf65ab2fd203d8216

SHA1 hash:

566d67116a5195f15c85810186894e457a66b647

Link:

https://www.unpac.me/results/514955e2-14dc-4234-a636-1451c6590c08/

SH256 hash:

296620e9308a1069ca98d27c426f25f5c1f87d9240bb371c657571034b0261b5

MD5 hash:

4cf24d41a7882216740280e3294cb853

SHA1 hash:

6bcb31d3dc0a7d71da1067a628168664202769a4

Link:

https://www.unpac.me/results/514955e2-14dc-4234-a636-1451c6590c08/

SH256 hash:

116ec927d44188d785b956cf26405a388a9fa35820f4ea2a783e6d739e22afe0

MD5 hash:

770cc582d1d8f337f194c3cbbbd7cab2

SHA1 hash:

a545082ea3b2600d1e5559a140e63b4f0cd5849d

Detections:

win_404keylogger_g0

Link:

https://www.unpac.me/results/514955e2-14dc-4234-a636-1451c6590c08/

Parent samples :

869fb5f7b10290ff21a86dfd49ad5cb09089f3fa543bb94282154596a431dcca
48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d

SH256 hash:

af4c009035cf267f19728436ca4760ee6fd517e61ef075592bfe5e805ffa7a04

MD5 hash:

17ab6fc4af4e98f844230fbb96479e28

SHA1 hash:

c725f5dbf79f039af6a6f4ddcfdb0b134f12f49e

Link:

https://www.unpac.me/results/514955e2-14dc-4234-a636-1451c6590c08/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/48bd479dd78532b0b8a04394e3bcc9d053484c1b43840cc40e453952b9f8161d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Phoenix Create hunting rule
Author:	ditekSHen
Description:	Phoenix/404KeyLogger keylogger payload

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184