General

  • Target

    Synapse Z.zip

  • Size

    5.0MB

  • Sample

    241031-nbsd5sylcq

  • MD5

    2d57b54cf0472ecd6ac6c31c5ed5aa04

  • SHA1

    ccb3f600ffc3a7711f951431ebbe7275f0813a5e

  • SHA256

    e5e08e06805507504311242781e7a892aae60c3b5c318cd579d710d31e529b50

  • SHA512

    bfdfe6d7465b17dc2a00411b669e86656309dcf6027c8c5753add968ae281462c7812eebbf9628a26c5da823aa6681669f4bc6026553f90141411852ee6f763c

  • SSDEEP

    98304:JxwmmdD8OM58DwLkFoLHBbCEIVrDJe25Ghy58a9ms6sFk:Jx5mdD86wLlTB2NJxk1ls6sFk

Malware Config

Targets

    • Target

      SynapseLauncher.exe

    • Size

      5.1MB

    • MD5

      0048a1911839e7b7999b62094e63cd84

    • SHA1

      bc646d549c9a3dca8ab17314984029333e863bef

    • SHA256

      6527b3540e93faebb9ad37addbb7ce92dee8bfa8514458fe953ad191801c27d2

    • SHA512

      7263dfe2d4bce3d1da6099228383ba2768cec5193385e6d9b49cf098102f3718b55db392177a9d307ccb4ef7c1e1000feab0ddf0350aade96774ff4e0e968d28

    • SSDEEP

      98304:IbXpR9Qy7Rh9KDmNzIorcZgML9XLKALq2BapfYoyFoWhrAnYr0o+K4:WXp57TNzIUO9XOAuKapAXFoWhcYrV14

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks