snappyclient | 1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284.exe
Size 3.7MB
Sample260506-tswe1set3t
SHA256 1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284
MD5 e5b563d7c2e16444b0cca5fc74bd750b
SHA1 9af245789963a0b5683a0bdb69e871fd2fcda8c1
SHA512 91a52dafd509f7eea1e7f2a1c5b074895e1cb1d5f1dd7caa7ae75c5cfedff943853d3ce33b60f4d9e8b32e8dde5ace174f0de187a84487396872245f6d490da0
SSDEEP 49152:7XfYRyfPlHkeRA0m0EqVG3MrajvT0XucYRNI5SV3lVVczpNF33zqVCaQVgKpS4FB:LfYRK+eR3IqVG3X0uNIa0nFnzJaB
TLSH
T14C068C32B9508075D3A20170DE2DAFB59FBCB62F07F249E777C8196C9A309D27936606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor stealer snappyclient

Malware Config

Extracted

Family

snappyclient

Attributes

additional_fields
false
buildID
Dang
cache_directory
ifeapspaithy
default_directory
%LOCALAPPDATA%\SonarServiceWr
directory
Didi
events_db
Vukirah
keylogger_file
Gore
shared_memory
true
software_db
Tayu
tag
Dang

Signatures

Family: SnappyClient
SnappyClient is a C2 framework with information stealing capabilities, written in C++.
backdoor stealer snappyclient

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284.exe

File Explorer

1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284.exe

.exe 3.7MB

1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284.exe

IMPHASH 660bce934863f801b30a074a0c558db1
SHA256 1409e490eb91be2e2fc90985d7740ce0b798e92328ccf2b2180a744c9724d284
MD5 e5b563d7c2e16444b0cca5fc74bd750b
SHA1 9af245789963a0b5683a0bdb69e871fd2fcda8c1
SHA512 91a52dafd509f7eea1e7f2a1c5b074895e1cb1d5f1dd7caa7ae75c5cfedff943853d3ce33b60f4d9e8b32e8dde5ace174f0de187a84487396872245f6d490da0
SSDEEP 49152:7XfYRyfPlHkeRA0m0EqVG3MrajvT0XucYRNI5SV3lVVczpNF33zqVCaQVgKpS4FB:LfYRK+eR3IqVG3X0uNIa0nFnzJaB
TLSH
T14C068C32B9508075D3A20170DE2DAFB59FBCB62F07F249E777C8196C9A309D27936606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2028961

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DepEVIbd\ASIOClient\ReleaseNoExcept\ASIOClient.pdb

kernel32

GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary lstrlenA CreateWaitableTimerW SetHandleInformation WriteFile TerminateProcess CreateNamedPipeW CreatePipe PeekNamedPipe DuplicateHandle CreateProcessW GetExitCodeProcess TlsSetValue TlsGetValue GetVolumeInformationW GlobalLock GlobalUnlock LocalAlloc CreateThread ResetEvent SetFilePointerEx OpenProcess InitializeCriticalSection SetConsoleCtrlHandler GenerateConsoleCtrlEvent LoadLibraryW OpenMutexW K32GetModuleFileNameExW lstrlenW QueryPerformanceCounter CopyFileTransactedW GetProcessHeap GetFinalPathNameByHandleW GetModuleFileNameW QueryFullProcessImageNameW GetFileType GetSystemDirectoryW CreateFileW GetFileSizeEx ReadFile IsDebuggerPresent CreateIoCompletionPort MapViewOfFile CreateFileMappingW SleepEx GetComputerNameW ExitProcess CreateEventW UnmapViewOfFile ReleaseMutex CreateMutexW GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount SetLastError SetWaitableTimer GetTickCount64 LoadLibraryExW lstrcmpiW GetModuleHandleA FormatMessageA TlsFree WideCharToMultiByte DeleteCriticalSection LocalFree DecodePointer QueueUserAPC RaiseException TlsAlloc TerminateThread SetEvent GetLastError FormatMessageW PostQueuedCompletionStatus WaitForSingleObject InitializeCriticalSectionEx WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW HeapQueryInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind CopyFileW GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer LeaveCriticalSection WaitForMultipleObjects EnterCriticalSection OpenThread SetThreadContext FlushInstructionCache GetModuleHandleW GetCurrentProcessId GetProcAddress GetThreadContext CreateDirectoryW HeapDestroy HeapAlloc CloseHandle HeapReAlloc Sleep CreateToolhelp32Snapshot ResumeThread SuspendThread GetCurrentThreadId Thread32First Thread32Next GetCurrentProcess HeapFree VirtualProtect HeapCreate FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AcquireSRWLockShared ReleaseSRWLockShared VirtualQuery VirtualAlloc GetNativeSystemInfo GetExitCodeThread TryEnterCriticalSection InitializeSRWLock InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx GetTempFileNameW IsWow64Process GetThreadTimes lstrcmpA VerifyVersionInfoW VerSetConditionMask GetEnvironmentVariableA QueryPerformanceFrequency AcquireSRWLockExclusive ReleaseSRWLockExclusive GetTickCount CreateSemaphoreW ReleaseSemaphore GetSystemInfo DosDateTimeToFileTime FileTimeToDosDateTime HeapSize GetVersionExW LocalFileTimeToFileTime SetErrorMode SwitchToThread GetDateFormatW SystemTimeToFileTime GetTimeFormatW GetLocalTime FileTimeToLocalFileTime CreateFileMappingA VirtualFree lstrcmpiA GetStringTypeExA LCMapStringA MoveFileW DeleteFileW GetWindowsDirectoryW lstrcpyW OutputDebugStringW lstrcpyA AreFileApisANSI SetFilePointer GetProcessId GetStdHandle GetProcessTimes GetSystemTimeAsFileTime GlobalMemoryStatusEx ReadProcessMemory Process32FirstW Process32NextW GetLogicalProcessorInformationEx GetPhysicallyInstalledSystemMemory CompareFileTime GetDriveTypeW GetLogicalDriveStringsW FindClose FindNextFileW GetFullPathNameW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTempPathW GetFileAttributesW MultiByteToWideChar FileTimeToSystemTime GlobalAlloc GlobalFree GetFileSize GetSystemTime DeviceIoControl RemoveDirectoryW SetFileTime SetEndOfFile SetFileAttributesW GetFileInformationByHandle GetFileAttributesExW GetCurrentDirectoryW MoveFileExW CopyFileExW GetFileTime CreateDirectoryExW FlushFileBuffers FindFirstFileW

user32

SendMessageA CloseClipboard SetFocus MoveWindow GetTopWindow GetWindowLongA SetWindowLongA GetWindowPlacement WindowFromPoint RealGetWindowClassW ScreenToClient PostMessageA CharPrevExA CharUpperW GetCursorPos PrintWindow DrawIconEx GetClassNameW GetWindowInfo GetClipboardData TranslateMessage GetDesktopWindow MenuItemFromPoint PtInRect SetForegroundWindow ReleaseDC GetThreadDesktop CreateDesktopW PostQuitMessage SetThreadDesktop CloseDesktop PostMessageW SetProcessDPIAware OpenDesktopW PeekMessageW DispatchMessageW LoadStringW GetWindowTextW IsClipboardFormatAvailable GetWindowTextLengthW GetIconInfo IsWindow UnregisterClassW OpenClipboard FindWindowW SetClipboardViewer IsIconic MonitorFromRect GetSystemMetrics SetWindowPlacement EnumWindows GetMessageW DefWindowProcW CreateWindowExW ShowWindow SetTimer RegisterClassW AddClipboardFormatListener KillTimer SetWinEventHook UpdateWindow MonitorFromPoint SetWindowLongW wsprintfA GetUserObjectInformationW GetRawInputData GetKeyboardLayout ToUnicodeEx RegisterRawInputDevices EnumDisplayMonitors GetMonitorInfoW SendMessageW EnumDisplaySettingsW GetWindowLongW GetWindowThreadProcessId ShowWindowAsync GetWindow GetWindowRect GetMenuItemID GetDC SendMessageTimeoutA IsWindowVisible SetWindowPos GetDpiForWindow SetClipboardData EmptyClipboard EnumChildWindows GetKeyState GetLastInputInfo MessageBoxW EndPaint BeginPaint GetClientRect LoadCursorW SetLayeredWindowAttributes RegisterClassExW FillRect DestroyWindow ShowCursor BringWindowToTop SetWindowDisplayAffinity GetCursorInfo MonitorFromWindow LoadStringA SendInput PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx WaitMessage CallNextHookEx OpenInputDesktop MapVirtualKeyW VkKeyScanExW ChangeClipboardChain GetForegroundWindow

gdi32

GetCurrentObject CreateDIBSection GetStockObject CreateSolidBrush DeleteObject Ellipse GetObjectW GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetDeviceCaps DeleteDC GetBitmapBits

advapi32

CryptReleaseContext CryptGetHashParam RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountSidW RegCloseKey ConvertSidToStringSidA RegQueryValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation GetUserNameW RevertToSelf ImpersonateLoggedOnUser DuplicateToken CryptAcquireContextW LogonUserW IsTextUnicode CryptCreateHash RegEnumKeyExW RegQueryValueExW LookupAccountNameW CryptGenRandom CryptDestroyHash CryptHashData CryptAcquireContextA

shell32

CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath ShellExecuteW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoCreateInstance CoCreateGuid CoInitialize CoTaskMemFree CLSIDFromString CreateStreamOnHGlobal CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitializeEx OleUninitialize CoGetObject OleInitialize

oleaut32

SafeArrayCreateVector VariantClear VariantCopy SysAllocStringLen VariantChangeType SafeArrayDestroy SysAllocString SysFreeString VariantInit SysStringLen SafeArrayAccessData SafeArrayUnaccessData

shlwapi

SHCreateStreamOnFileEx PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathFileExistsW StrStrIW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChain CryptUnprotectData CertFreeCertificateChainEngine CryptStringToBinaryW CertGetCertificateChain

ws2_32

setsockopt ioctlsocket freeaddrinfo htonl getsockopt WSARecv connect getsockname getaddrinfo WSASocketW WSASetLastError listen shutdown select WSASend closesocket WSAIoctl bind WSAGetLastError __WSAFDIsSet htons WSAAddressToStringW ntohs getpeername ntohl recv socket send gethostbyname WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent inet_pton inet_ntop WSACleanup WSAStartup accept WSAWaitForMultipleEvents

bcrypt

BCryptGenRandom

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ktmw32

RollbackTransaction CommitTransaction CreateTransaction

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

secur32

GetUserNameExW

credui

CredUIPromptForWindowsCredentialsW CredUnPackAuthenticationBufferW CredPackAuthenticationBufferW