Extracted

• • Target
    gettwo.dll
  • Size 4.6MB
  • SHA256 43a583df5c6cd71c2fcf609b67560dfb1617163dbdd08b7bd6f42b30ec20f068
  • MD5 a6bf7c599e35ffd446d1f31b408ef308
  • SHA1 72d771933621ba4419ebeefd48b893db0a39ffd1
  • SHA512 abd39f411d53241fe0ad98a4d71a01bf18f1357de7daac8254f2487506b11d11f16276b9d99a94e3aa9386d5d4b3d405d4d30ae5b8be093105c43c437b922673
  • SSDEEP 49152:b/5sFU2MwK5eJ/OHlpiIyG42IQVyCDgigjeTqVWxGPSsL2t+ajyQcTBtCG:b/4nJ/OF4pQVyCOBOk28UY
  • TLSH
    T1C8264B1AACF91CDBC0B9F134C4736206FD62780047225BC716E1A7692E77BF15AB6B18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverysnappyclientpersistencespywarestealer

  • Family: SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2