Extracted

Extracted

• • Target
    bwes.ps1
  • Size 4.3MB
  • SHA256 af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
  • MD5 99505f14a6ba31a2f2d6c673d7d6b3c8
  • SHA1 98c4acb3a0dd42ffb0942311ce5b4a0a0af6472e
  • SHA512 9ef16d05a883db1ea7465d1b33fbc6d72287efe707dfcd1673086cb1a784c359bc130eea770bf194603d0fcab742c40ae7be226d4508cede67bbae4256dc738d
  • SSDEEP 12288:NK1AzT5tMUpYdu1whlf9to2I3GChnQIVe+mjM4Ess:N1txYdu10llta3hhnQMeRM4s
  • TLSH
    T13526D13AC132FCCA4E9C3B42C5BA0E6B159C7945C7BB1D65DB0C2DFE35A2B909E10658
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderloaderpersistencespywarebackdoorghostsockssnappyclientphishingstealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: GhostSocks

    GhostSocks is a proxy malware written in Golang.

    backdoorghostsocks

  • Family: SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3