d9df119c8b4453012914de89192f36c7f593919f76daba99a0545ebba8ca2e08

Sharing

Copy URL Twitter E-mail

General

Target
Snatch-2026.705.2328-setup.exe
Size 218.3MB
Sample260707-mz23tagv2v
SHA256 d9df119c8b4453012914de89192f36c7f593919f76daba99a0545ebba8ca2e08
MD5 46c7a25f34737bbbc5cf9fe751cfbc49
SHA1 3700b835b8e1520552d5caf8a6b0138609ff7e77
SHA512 becea66500fb3f02565bda772b72b8bc6c388ee6d9efc8d2f09fae9c4f21ee8b8353a24eeb687c07ebfcd18762edaef946e56a33bb851e9b8d541424ffd889ed
SSDEEP 6291456:gTbA+Lc+5iIcv+47XNI33XUySWjUGelIT:IHLr5ixG47XNIHXUZWSlIT
TLSH
T1F1B833C43462544A52E4CA72FDF6A33371AC6D6C53EC80A92262957F8F7C0D7E363269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Snatch-2026.705.2328-setup.exe
- Size 218.3MB
- SHA256 d9df119c8b4453012914de89192f36c7f593919f76daba99a0545ebba8ca2e08
- MD5 46c7a25f34737bbbc5cf9fe751cfbc49
- SHA1 3700b835b8e1520552d5caf8a6b0138609ff7e77
- SHA512 becea66500fb3f02565bda772b72b8bc6c388ee6d9efc8d2f09fae9c4f21ee8b8353a24eeb687c07ebfcd18762edaef946e56a33bb851e9b8d541424ffd889ed
- SSDEEP 6291456:gTbA+Lc+5iIcv+47XNI33XUySWjUGelIT:IHLr5ixG47XNIHXUZWSlIT
- TLSH
  T1F1B833C43462544A52E4CA72FDF6A33371AC6D6C53EC80A92262957F8F7C0D7E363269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  resources/engine/recon_engine.exe
- Size 14.0MB
- SHA256 1c6e20f591063f2ee7ab6ce3e8dd1be7abe00dffbcb160444714dd93fc041f7f
- MD5 5512f8ae5f1678b8f67461a6af066092
- SHA1 796f53662afcbd7b11f1f973cd180c833a4dbac0
- SHA512 9256fa11bda8a8ee6eebb7bf90ee7a18f2dbb8b9339f67ebb1758089277d041063350abb3194b91e3393f069c58c1688be47cf9d38c5733299573876be500fb0
- SSDEEP 98304:Ajfdkmn5rH5BoYVt1nlnx1Vp6dszZV/MDVLud+i1TobZlAtf+qdae7dWbWF:I5rZBHx1uwgVC5TobUVhdzRW
- TLSH
  T1FEE64B527A8A59ACC14AC474834A4B325A7130EF1B35BAFF44D496393FA9AF01F3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7
- Target
  resources/runtime/node.exe
- Size 66.6MB
- SHA256 35b7c95a379beb606f5798ed83081690df13190077630b234163c6607aa4cc94
- MD5 5e3aba1cbda9f8bb9bbb279f6402e0c6
- SHA1 299b38a2291b2c13a4f9d7f312605061bddeffa6
- SHA512 73b92a7606877fe204784021bc57a735b85f46e933eff94eb8b4ff0c9c45c2b0c35f3a76ba89de847e1727537d93b1604c8a4b22507666d5d26afe3262da77bb
- SSDEEP 393216:ZQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGI:Z+3LQxhnLUYg3mdRovxOOxUj/4
- TLSH
  T15DE75A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  resources/server/.next/server/app/(auth)/login/page.js
- Size 1010B
- SHA256 d367a024bbb8edc11cb0f73d7930a1d328e72eedf5f01a826724f064eeede4d0
- MD5 7c22f03ed893e17160e644b1e5626af8
- SHA1 931774af8f30c7865d57fe4fccf0686eb8592168
- SHA512 cc760c0fed9e8a03538afd621e34981fd85f7f44be7c5571cfe370baf029a0b841d1257d2a4e3e05612d3e0479292624c466a4cec13b519aa9f6498b13c2f894
- TLSH
  T10B11087FA828FDDFF0E48D7D89D5D300D79A58B199AC294547D828ABA08B80043B8CA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/server/.next/server/app/(auth)/login/page_client-reference-manifest.js
- Size 48KB
- SHA256 c89bc1a7611e344c202f684a5782795f570c3250e925d2252a8f156123fad216
- MD5 996779ca0a6d4a3bfa92f8875b3dff3a
- SHA1 7dca29cf8dbe388d8b8f6e67d9a8ed4bdbd097cd
- SHA512 c839c9f421b7e39081208897588e782ba23f38abc8689c9b297f9e1b7b90d1bb9304513f9594f11deae83e4b516b4fa486094fd7fd55b68e92e2082ceee92243
- SSDEEP 768:x3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9Oi3wVbog:d
- TLSH
  T1E123056FD80AFD9E9AB8CD1DAD1E632295C59C7394742C9CE79C8CAF005A43147ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/server/.next/server/app/(dashboard)/ai/page.js
- Size 1KB
- SHA256 d441099a72106a7e1953f71782ada94f5eabf6c9a6e4c7be90cde3e471b75637
- MD5 8e344440877fdb7ab587bc4deeded77b
- SHA1 81214a335ced4670f821dfbc18b80b2b5c42c3fe
- SHA512 b7191aef0ef84a6c245efa4add3fb699857c8ae65920ff5d21fbd2ef7648169f4aa338ec3e6a6f0972c94b39ef01c1c4b13c852b10e31789e82188189e740296
- TLSH
  T1A521DD7FA818FDDEF4E89D7E86D5D300D7D664F1686C288657D82CAB944B80043BCDA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  resources/server/.next/server/app/(dashboard)/ai/page_client-reference-manifest.js
- Size 127KB
- SHA256 3de7cb961a132f88bbcf7f2a38ca95fa6a634721f591836921daacad748f0798
- MD5 342268c274f4ee96beb2266aff7c018a
- SHA1 2845fa82d1017791c7c78fe1ac4541bc9f195cf0
- SHA512 39904d2c2f503af5aad973062d873a25b93b59dcf11fe577d1c30e7f91b23ebd8135d6ae77a68462c152a076f02acff1687cdb1f4467bdc2108245238a360bf4
- SSDEEP 768:S3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQ0:uyi
- TLSH
  T174D3166FD81AFD9E9AB8CD1DAD1E631255C99C3394742C9CA78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/server/.next/server/app/(dashboard)/axiom/page.js
- Size 1KB
- SHA256 11a803f7487f5665b5fba66d87d89ce3060778919cce224a84bde60399f1b54f
- MD5 8b3ab0faab4806b9164e8da164345818
- SHA1 12505cc35d37d8cc67428897027fa270d1c1b111
- SHA512 415f89f472bf646b014945e18bd3aae6537ddeca4fbb84e2b4e01b1207d054ac2a7a05e7f58ea8dca5104b2ce53c53e8cca28ccd762568b0b5cc7e93bd9098ee
- TLSH
  T16E21C87FAC18FD9EF4E88D7E86E5D30097D658F2686C288557D828AB944B84043BCCA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/server/.next/server/app/(dashboard)/axiom/page_client-reference-manifest.js
- Size 127KB
- SHA256 41e80c1fb946134f268f001b227c79b08ef8cec7434765a85d474a016e180c95
- MD5 b6c54950a009ddc50cfc04ff59f8c91d
- SHA1 c398eaf6ba1468e03c126f87546c4d2b5f198a4f
- SHA512 c9de7a773dd814b7e4e73592c8bc6c4f95c2daaa9059a64dd31788b37baecf0e68a2730e6f26deec008475a375840e78e2089343b285db615602c657f5e6b159
- SSDEEP 768:w3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQB:4yb
- TLSH
  T143D3166FD81AFD5E9AB8CD5DAD1E631245C99C3298742C9CE78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/server/.next/server/app/(dashboard)/dictionaries/page.js
- Size 1KB
- SHA256 09fd64d4578e6b9399a530fc27c9c834f33e26d04e34b1bc57f826e4d44fa1a7
- MD5 983ac26a96abc5224a6a167d0032242f
- SHA1 81dd3f830ed4d1accf747f6d486bf06eda3f37f5
- SHA512 06264004df66735b3924bc50e00a88f0f11e8f627ec38e3d4ae2a0a3654a45bba3c23d5a5ed1e0ed28421ea1578fdc880aca59a5544809a3475a6821b0be2601
- TLSH
  T13421F87FA818FDDFF0E88D3E86D5D30097D614F2686D298553D828AB944B80043BDCA1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/server/.next/server/app/(dashboard)/falcon/page_client-reference-manifest.js
- Size 127KB
- SHA256 0ca24cb48c0523896c4b881ff4694ce6d466fb98c2c4183976fa6b32b7920a71
- MD5 be83ff5cd3dbaec1a5399c25c128de44
- SHA1 12c3913fc14b6a0152d5e483d285d29e6c86cb2c
- SHA512 aec4847113d183ac5c64782387349fc1cf2e187e4b082951b96cd6635c3cad0253755793a74d909758d5644045d4a1f57ece42eade47bd28adde6aa2530bd8e4
- SSDEEP 768:H3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQN:hyb
- TLSH
  T128D3166FD81AFD9E9AB8CD5DAD1E631245C99C3394742C9CA78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/server/.next/server/app/(dashboard)/graph/[id]/page.js
- Size 1KB
- SHA256 848c9c57fc97a78f2e61cf9709da884869ccb16da9885eb42979365294626749
- MD5 623996d16b2457045d8f682ae909ed8d
- SHA1 de8f05245e22d00a8738b9761fb32b7fee075d1c
- SHA512 cae274f239f9f60138f96ad778970feb236c7174a5de2c4e6608452407abd7e22f997eb245f1065822ac418d66924f63c00bc2c13dc1f8076aa650aa697728e5
- TLSH
  T19E210D7FA818FD9EF0E88D7E85D9D300D7D664F2696C298547D828BB904B80043BCCA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/server/.next/server/app/(dashboard)/graph/[id]/page_client-reference-manifest.js
- Size 127KB
- SHA256 836f6aefff4606c6c28911d66177980190794476c2476ff2c5b0bcb49733d6ca
- MD5 724d132944e789f93f39013dd6dc4d4b
- SHA1 b2345a110236e2b1a6d4ce270bd9a35991fe4bf2
- SHA512 8c4aecff17669e1d579c49d2face941f7443298523248e6f1ee6a1847646dc46ffabac87b9157d60ea915ab615df637e9545d22e4dfadc7c127016c2c610ab5d
- SSDEEP 768:O3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQ4:SyuD
- TLSH
  T1EBD3166FD81AFD5E9AB8CD5DAD1E631245C99C3394742C9CA78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/server/.next/server/app/(dashboard)/graph/flows/page.js
- Size 1KB
- SHA256 831c770c1aa54aee1f635b05dd20f9052739863396a4eacc50e3b2408ebfb195
- MD5 b6c9eb493c731fafe4b9ffc4f6cbec8e
- SHA1 84b4520e2eaa29d96c05f04d647119aa5a6bd4db
- SHA512 3f33a9dc34dbd76f5d59e6d584141b419912eb1381034c8c3f518e9ae0191c85865c150e15ec6232874eb9752007ecebb15a59a8309dfc7fa16f51942917f216
- TLSH
  T1A521C87FA828FDDEF0E88D3E96D5D30097D658F2696C298557D82CBB904B84043BCCA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/server/.next/server/app/(dashboard)/graph/flows/page_client-reference-manifest.js
- Size 127KB
- SHA256 37ee1ca658e484f220f1f647446c48817eb74dc9be2c99d1d25ff6435565f46d
- MD5 53ec4c8d5a850080dd257781d34ba7aa
- SHA1 c69769107df5d51bb2854e8bafbb839efbe2140b
- SHA512 3091cbf8ba4d70360e9657f87fbfdb6a0c6bcf2b2efcb380e26243cbc29ae39dfc200360e31d75c7393b82d854e3fee7b5a71fe82399148993aea0f466833283
- SSDEEP 768:63RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQb:Gy+S
- TLSH
  T166D3166FD81AFD5E9AB8CD5DAD1E631245C99C3298742C9CE78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/server/.next/server/app/(dashboard)/graph/page.js
- Size 1KB
- SHA256 d9b21e324fe8a2039c6c08abb774dd64ee77ab5e55ec5dd3acec39a965165ef4
- MD5 ecd8d41127ddd3cd760ed74387539da9
- SHA1 26b7d42af3023c901387e0edaf7fbf5a8a5a2b99
- SHA512 26ea9282627b74e2ad42382a423db41e21f76cf52c5ca0e685b7fdad335f95885f16507bc1ddfb9fd6074b59a8c728ae6ee1a8971ea3cf21276d2b13a8edd913
- TLSH
  T1A221DD7FAC18FDDEF4E88D7D85D5D300D7D658B1686C288557D828AB904B84443BDDA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21
- Target
  resources/server/.next/server/app/(dashboard)/graph/page_client-reference-manifest.js
- Size 127KB
- SHA256 1fd6afb3e5276d8abd108a83925a4a6a4ebae3e876512a0f6083109ef26765b3
- MD5 85ae611148ae9f9d4d377313e5948755
- SHA1 8aa4e240fb276d95762c3441f0eb9913725232c6
- SHA512 88339692df9b653a1c2a799014f503bf8f2ce33a8865887cdde47f23727b62515cab24dd7312847bbd7dca385a79fe48aba9113c91a81855a13872adc5a14a25
- SSDEEP 768:s3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQD:8yZ
- TLSH
  T154D3166FD81AFD9E9AB8CD5DAD1E631245C99C3294742C9CE78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/server/.next/server/app/(dashboard)/integrations/page.js
- Size 1KB
- SHA256 edd363fb5649631149cc267b8d7bdf64416f4beb0248980da741cfa78d790f3b
- MD5 6b3cbe0b96902f76c24cc223f9ab3a3f
- SHA1 26afdf90636b1e8e15a6c25f0b7eb39ce62a9724
- SHA512 cc844042530c776dfcb111a76b7398e0955669f88d5db62982187069a5d66d4723782101209d421563248f855495e56c5c59d12ccf282a2e379f316a233ef136
- TLSH
  T1AD21DD7FA818FDDEF0E88D3E85D5D300D7D658F2696C288657D86CAB904B84143BDCA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  resources/server/.next/server/app/(dashboard)/integrations/page_client-reference-manifest.js
- Size 127KB
- SHA256 42174ffb1c60f8ab11f26f62ae17e3fd8ec1a7e02004543a4ac325dcad7c3b20
- MD5 69c03fcfdaecbe7a1afaa53e0ced5f0f
- SHA1 cc68d42304920a233c035ce436032807b84e9189
- SHA512 6b91a673b4e08a6892b2d893c7dd30147d8031c71fcef7edd0a9ab8c5109f6122a2d591cdc5c24d75bb29088693c4f6a83f1683a21a38af1a23ad1f38e59a50e
- SSDEEP 768:h3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQO:vyE
- TLSH
  T1F4D3166FD81AFD9E9AB8CD1DAD1E631255C99C3394742C9CA78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  resources/server/.next/server/app/(dashboard)/news/page.js
- Size 1KB
- SHA256 de51ad88c7ec5e97b6c45fdaaa945992fe8f28ee4c983eaa6f7078912a309243
- MD5 e353af01a48fd6161fc444ffa9687682
- SHA1 16ffe47ecd15c4706560e541415c789ffb6423e2
- SHA512 cdba687e548f8694e408ccb91abb8cfe35294149fbe15d4e360a788caa6a4c18941743aed500269dcfa0ec84422df563a45beb17581eb4b572d86d536afb0287
- TLSH
  T11921D87FAC18BDDEF4E89D7E85D5D310969614F268AC288557982CABA04B84043BCCA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/server/.next/server/app/(dashboard)/news/page_client-reference-manifest.js
- Size 127KB
- SHA256 3fef4408d088885c7cf6f96f1d3d116f94697f4c3c62522850f226e9eafb99f9
- MD5 a28ea2273fe3bdf35ab790f81d64ebce
- SHA1 321cb93f5d015994ae1d9caaf379e461970a9055
- SHA512 b4eb17b6adaeedcca44e8efa4dc2600ac494ecda05e5e8c3359d4abdcb40904073c3beec3f3413d5ecceaa260800717eb0f8c13c3397a6380c3b75d1cd4b7385
- SSDEEP 768:V3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQ/:ry9
- TLSH
  T123D3176FD81AFD9E9AB8CD5DAD1E631245C99C3294742C9CA78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/server/.next/server/app/(dashboard)/osint/spectra/geoclip/page.js
- Size 1KB
- SHA256 0c28f58cde4cb3105583de50d9770ace77cf164fd8f08fb8a330589d2632bece
- MD5 7688613d1ce2c86f58433b4e037f905a
- SHA1 1b10b724a458e7e303e9c77d7dffbd7abf670b30
- SHA512 4cc0695050d3af21d043b386e710c85bbad37704b93c85217cd472d7ecab07f0988911e7a6f907e27abb837f2950a344298d67f1ed814335a1dc0ae817aa3362
- TLSH
  T17821FD7FA818FD9EF0E45D7D86D5D300D7D618F169AC298557D82CBBA04B80043BDCA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/server/.next/server/app/(dashboard)/osint/spectra/geoclip/page_client-reference-manifest.js
- Size 126KB
- SHA256 9cb6d747d6a2fd3e5b7e89b20a8c2bcd6573409fbcaf1713343066fb8859118b
- MD5 4b4c108a2a7f9f6366688807907d825d
- SHA1 14c1318723d4fdf94b2e836d855ffb9253bee2d0
- SHA512 ac3da6d876808c94cadc4f8954126358e3ed48eac13c016a21d868a601d0426fbb79684b33bd3abe60aa361f8c670d71b66024278aaf777be77b5ce3ec33c0a9
- SSDEEP 768:U3RFptfvn/qOyKFVVh+eTrdVl5aSCm7gsev9H1YA+S0gI02CTXQRQJRx6mIoQHQs:0yG
- TLSH
  T11CC3166FD81AFD9E9AB8CD5DAD1E631245C99C3294742C9CE78CCCAF405E42247ACCE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $R0/Uninstall Snatch.exe
- Size 130KB
- SHA256 77bc34e21c045e639cbaee4960303138c5f41d3b213886c07a6f598ef5b220e6
- MD5 33124e0289882895c2f7f03a30ba0bb6
- SHA1 9d5b57a4cd91143f9865e67a680074fb395680a4
- SHA512 e72cc9abcba301223d7a80168972b67af6336648882e0319702f3b1e3b369725cf61a84ce80fd5284fd8df4db5830560c9f79286446eb5722695f7562ecf2fe3
- SSDEEP 3072:qn77v00hEoDEtauc/UBR0jnQka2MNUa8b32tvhOEA1RJCir86SrSrv6Ia3r:q740I1kz12Ua8T2t0EyL+ya7
- TLSH
  T1F6D30110B7A0C167FAFB4F730B6942AF5DF9911124789F430BA0679C39A32A5D64E3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Looks up external IP address via web service

Enumerates processes with tasklist

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32