2024-04-30_6093f9211213f973b863ebdb1273ed3d_snatch

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-30_6093f9211213f973b863ebdb1273ed3d_snatch
Size

14.6MB
MD5

6093f9211213f973b863ebdb1273ed3d
SHA1

a64afdd8298f950e4bb4c7e3ac7b09677ad258bd
SHA256

6c2effd92f454c24dd7f6e92c8fb2b59decfaa2005922f605eb34842928163f4
SHA512

1c7593cfde1905655f0f8c51638edb875ce2b9034975049f3d07adb311fc9d48ebb3a0121616eb55b036a448089641f8a58e34db30585bda46964d0337584ef4
SSDEEP

196608:koQTR8aMEII2BSyiAaUmw4LUuBB0T+NSxiZ:kap4iQUy02F

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Files

2024-04-30_6093f9211213f973b863ebdb1273ed3d_snatch
.exe windows:6 windows x86 arch:x86

91802a615b3a5c4bcc05bc5f66a5b219

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:57:2c:9d:1b:7c:e0:60:e7:44:b5:b8:06:41:57:72
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/03/2020, 00:00

Not After

11/03/2022, 23:59

Subject

SERIALNUMBER=201812738K,CN=INNOVATIVE CONNECTING PTE. LIMITED,OU=Technical Department,O=INNOVATIVE CONNECTING PTE. LIMITED,L=SINGAPORE,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

89:d9:5f:8e:b6:39:0c:86:b9:87:41:5f:c6:3e:eb:12:97:22:43:d9
Signer

Actual PE Digest

89:d9:5f:8e:b6:39:0c:86:b9:87:41:5f:c6:3e:eb:12:97:22:43:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 381KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 938B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91802a615b3a5c4bcc05bc5f66a5b219

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

27:57:2c:9d:1b:7c:e0:60:e7:44:b5:b8:06:41:57:72Certificate

Extended Key Usages

Key Usages

89:d9:5f:8e:b6:39:0c:86:b9:87:41:5f:c6:3e:eb:12:97:22:43:d9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 6.5MB - Virtual size: 6.5MB

.rdata Size: 7.7MB - Virtual size: 7.7MB

.data Size: 381KB - Virtual size: 481KB

.idata Size: 1024B - Virtual size: 938B

.symtab Size: 512B - Virtual size: 4B

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

27:57:2c:9d:1b:7c:e0:60:e7:44:b5:b8:06:41:57:72
Certificate

89:d9:5f:8e:b6:39:0c:86:b9:87:41:5f:c6:3e:eb:12:97:22:43:d9
Signer

.text
Size: 6.5MB - Virtual size: 6.5MB

.rdata
Size: 7.7MB - Virtual size: 7.7MB

.data
Size: 381KB - Virtual size: 481KB

.idata
Size: 1024B - Virtual size: 938B

.symtab
Size: 512B - Virtual size: 4B