Extracted

• • Target

    snss1.exe

  • Size

    3.0MB

  • MD5

    33b57a0801027e2850d708a8418fab81

  • SHA1

    025970a55f120a20c90ca646fe48ac315482b16b

  • SHA256

    2126e2d225b9b38190cba5627877bccabc5da5f57443731c8ee292eecec51091

  • SHA512

    50a7c77f3e00715b5efb6c6501856849636f428baf1fd50ab48da507685d19f4bfd27350048501833d5a6e5a81e37bea2f4d584c4413ef40b46863057c49ce65

  • SSDEEP

    49152:+UvC/MTQYNsWy7aKVN/vndlsKwxEO0YTUD6CsRBJgsoDDeQ:VjTQYNsWy3NndlsdEO0YwWRBSpDDeQ

  Score

  10^/10

  hijackloaderstealcwasp4credential_accessdiscoveryloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2