Extracted

• • Target
    IMG_TENTATIVE_AUDIT_PLAN.exe
  • Size 505KB
  • SHA256 41e39c9347ae609ed82773dcf1c9a94848e6351dd1d93ca6d69225d684dba6d2
  • MD5 0c926d01a5dd053c5923cd8c9f4d2e41
  • SHA1 3b0663393acd23c388cd7cfb0c6b667a03be52f4
  • SHA512 17191e955a26ba7f9473668a8fffd2d5207a5b3e18fd31876fdf5fabf3b5ce5bae6c7eba53e02af75153c8c0686450db780d521592b00a86ff9ecf38d142330f
  • SSDEEP 6144:pMm4CCdCDZ+0Ci5kDTT8l12N+7dDSHenzHR6JrtWmSMjMojWmSL5/X/caW4ysgA:pMw4Cc0CajEopDJzutWs1WmAPM0j
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryguloadersnakekeyloggercollectioncredential_accessdownloaderkeyloggerspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6
  • MD5 08de81a4584f5201086f57a7a93ed83b
  • SHA1 266a6ecc8fb7dca115e6915cd75e2595816841a8
  • SHA512 b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9
  • SSDEEP 48:S46+/1TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mLofjLl:zHuPbOBtWZBV8jAWiAJCdv2CmeL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6