Extracted

• • Target

    2024-08-25_6306c8b9dd7f426c94b26bfe3c8eea0a_poet-rat_snatch

  • Size

    14.0MB

  • MD5

    6306c8b9dd7f426c94b26bfe3c8eea0a

  • SHA1

    f2677719e81f9aa8c893552605d077c6462867b8

  • SHA256

    9e3540f2a70e61ea94d7c79f7b18a242014647693e802d55b0beeca7eee2bcb9

  • SHA512

    34689c6c5740d3cb4a73c31b35c7caa0a212f95fc24beae4019a045e28334d8bcb82f9a71c5bb3b5ce147592a4dc9309aedfe82cb8e0221d24256c2809f5674d

  • SSDEEP

    196608:ZjVyhpZ9CKRxcoPqJvAcfYmqQoYiPi9S:Zkh3ZRxcoyJ4cfYmnT

  Score

  10^/10

  credential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Modifies Windows Firewall

    evasion

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2