MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfa902295e508fe2013b7028ebffd7b66e54180388161911d75457ce605005e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfa902295e508fe2013b7028ebffd7b66e54180388161911d75457ce605005e4
SHA3-384 hash: 9ba41884c51fc22380e058f41b2490942bb446e28e5d1d20b3e46d5e77a78b82732cc949736f98af2ea245012bfbdd68
SHA1 hash: 68083bb8c8ee121d17ca21dcef5f9523437d617d
MD5 hash: b945b27d81e42701d10476f95f6cdda8
humanhash: cup-blossom-quiet-snake
File name:anandz.exe
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:924'160 bytes
First seen:2020-04-01 10:16:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a17563c04d15b724e8cf090518294c73 (5 x Loki, 1 x AZORult, 1 x 404Keylogger)
ssdeep 24576:PmJdKKKjmhyVg1euXPgJSLZbM1S9ZhbqAqOjJ:P/KKKhmWegK8ZoI9Z9GON
Threatray 1'920 similar samples on MalwareBazaar
TLSH DF15C0E6F2E04473D1272A389D1B97B4AC25FE102F2865666BF91C4C9F396C1383B1D6
Reporter oppimaniac
Tags:404Keylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 10:35:39 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6uqekk6kch6eaj3oauox76xwzxfigadralbseoxkrl44ycqaxsa._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
1fc0b64aa5ad4ffdfdd207d5d59dfe238ab1573b793d6da0dca9df7918fdad9e
404Keylogger
275bbcb68e33c663127f056fcf9d69330bed4510ce97ff8977bef6caca29042a
404Keylogger
441722dd08836654f243e5ab8a27da0a52ac6d1eac0e33c25e81068ce049338c
404Keylogger
5c2ea777da33a621b23492ec92638ae11c24dd7f77e9607277d77a7a02f5ee5b
404Keylogger
6645ca72c1da8e6325dc17645413624742d223df8ca65c6a178ff600bc00cb52
404Keylogger
6a5bf81d82a8112290a0eef40ece993c13143ad63feb1b4452528187a98627b0
404Keylogger
8f746ab02591cecc45226d28bf483dff6616f697c1d79f8d1daddd5e8ba1d764
404Keylogger
ad75e1f7e686538860a9ae28ba0b68fb3c528c403618cf34b26a2b541e7bd0a2
404Keylogger
c4fc5587f9e3741efbd7aca1ef0a1b2471da6c62a02901b9929ac7239e6fd04c
404Keylogger
e88d0c4baceb5c60db05c244764d3805fd453d268fdff9101e82d49eceb2d0b8
404Keylogger
+ 1'910 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:win_404keylogger_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT, Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

404Keylogger

Executable exe cfa902295e508fe2013b7028ebffd7b66e54180388161911d75457ce605005e4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/333179/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play Multimediawinmm.dll::mciGetErrorStringA
winmm.dll::mciSendCommandA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::VirtualAllocEx
kernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments