Extracted

• • Target

    OPH21.bat.exe

  • Size

    622KB

  • MD5

    d5823a84e4b8e1cf3d66e71c0bfdc634

  • SHA1

    6f21f997a4f810f899bfe07fbeeb231c3594b773

  • SHA256

    2c02e5bec85fedefe1d21d2cc02b0d7e91eebfedcb53f444127463987de67bc0

  • SHA512

    88cd67b071413ce6cee8553e64c007ae16c7b83efcc271fdf8887c69a1835f0983a6f093a67103048ed1182432fabc566b42ebf5a5f80811eaece0b1750f6af7

  • SSDEEP

    6144:sMm4CCHM4NL26fgvQVA2QNzTlIWFLVEXeVwp9gSGmsBYnrfs:sMwg/NL26fgvQK2QN6WRVAgSGm+Ynrfs

  Score

  10^/10

  guloadersnakekeyloggercollectiondownloaderkeyloggerstealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2