Extracted

• • Target
    gettwo.dll
  • Size 4.4MB
  • SHA256 676b6835f7a819ad5f0c19b7825c9151a0c1b3d79219f1a470043f1240b04131
  • MD5 093409ebb68f40bc442f5b35ee6a2287
  • SHA1 7abf08aee4cb234e68c3659bc9fe436391ba94c6
  • SHA512 6b0f291eb7ccdd5c924f768471156cacbb98c2aebbcdf782ccf53752510b9466699041daa10b2c1ae43830438e948217c4edc6cbac2fb6ee6548e8f029aa05e6
  • SSDEEP 49152:El77JEqO0Yk57ntOt90vaL2/Csw7q8YnkmhhjYQcTmioepY3va:ElNZoYaLBWhku
  • TLSH
    T10A264B1BACFD4CEAD0A9F134C4737212FD61780097216BC71AE0A7691E277F15AB6B18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverysnappyclientpersistencespywarestealer

  • Family: SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2