General
-
Target
Synapse.exe
-
Size
17.5MB
-
Sample
240512-ewyxzsbd26
-
MD5
0c015a50850cec3d831b97980180b73b
-
SHA1
3a95c7334e446975d3d22a753075f4941a00177c
-
SHA256
fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
-
SHA512
47f49f646f0141f0f5cba08269ef3780f2e1d85707f32b94c363c208af827b82c0e1d98355da1e0240cb93eca6d3337b382db84a549ba93759bb719383eb2e84
-
SSDEEP
393216:pv90+5gDTj5L1V8dXurEUWjsrfTbEkPKkvbuK+x:l9PkNRkdb8fTbIkSK+
Malware Config
Targets
-
-
Target
Synapse.exe
-
Size
17.5MB
-
MD5
0c015a50850cec3d831b97980180b73b
-
SHA1
3a95c7334e446975d3d22a753075f4941a00177c
-
SHA256
fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
-
SHA512
47f49f646f0141f0f5cba08269ef3780f2e1d85707f32b94c363c208af827b82c0e1d98355da1e0240cb93eca6d3337b382db84a549ba93759bb719383eb2e84
-
SSDEEP
393216:pv90+5gDTj5L1V8dXurEUWjsrfTbEkPKkvbuK+x:l9PkNRkdb8fTbIkSK+
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-