General
- Target Synapse.exe
- Size 17.5MB
- Sample240512-e2tkfsbf56
- SHA256 fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
Score
9/10
Malware Config
Targets
-
- Target Synapse.exe
- Size 17.5MB
- SHA256 fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
Score9/10-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Synapse.pyc
- Size 1.9MB
- SHA256 7247caf33200a867f3957f2bd70a10e6f4fa319a904c0e77a5620de69dc1f3ed
Score3/10