Extracted

Extracted

• • Target
    kythy1.exe
  • Size 6.2MB
  • SHA256 94db5892d51fa7f24c6f406591d5cc143f48f3f9f576c66d36a8682e3950102b
  • MD5 162ff0e44be47582afbdb55d63f9a760
  • SHA1 4b044deef0ffb8120751dc28a80231d938d67e05
  • SHA512 ff426ecda13dd59a46bf994b35c119eafc2e170069c663b8e74b2bef60b7a958f30668b6d86717a1190c8b18cd7f129083b2625fd487e37165cfde6ee486c64a
  • SSDEEP 98304:+ppHzgns7ZEbnfIk/mUNm5Q8D0s7nWBT3NzSvu2nMsIaekBN33gQ7RFDy6gw7E:+pBzUs9Ebg5DbKLNzSvuSMPaekXpzBlA
  • TLSH
    T12E56330937A4FCE5D231C2B3CF2CCB564472EB9692881E1347967E866DE34A5410F9EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealerbackdoorsnappyclient

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2