Extracted

• • Target

    Q1343 Q1344 240 Dishware.exe

  • Size

    1.2MB

  • MD5

    1ccd7ec5e3adf4355e77bcc1f2f64b63

  • SHA1

    d5a42f6a179d2a63bd0912a2a728334d0594a92c

  • SHA256

    f8a9dd3d1e24b6e889dc9b8e752f442bbf2527d97bb5028bbb95c94ce262de67

  • SHA512

    ffc228c1b5e12cbb230bbc81456af5d841892e79fdc6dc470b30896abbcb85bf84438e668e52aa057148ab4537bea256d0fcd0f15c43c7148db46e2bb9887a0e

  • SSDEEP

    24576:RB05LEShOyOMs+pUcwAJk4TALNqeOMz7Hc3WCqD2wAG:yEShOaFwAJfAQeXz5C1q

  Score

  10^/10

  purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderpersistencespywarestealer

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2