Extracted

• • Target
    SAMURAI SNOSER.exe
  • Size 20.2MB
  • SHA256 d22f1c095f173d57b30824d811c9d573127132afe824d7739ab22f262751d691
  • MD5 03c9cbc8de81c0967aa089dfb1b9dca7
  • SHA1 d400b79dd82d303aeafee53a0f15acbbcf310f60
  • SHA512 5e6ffaacce294887c795e4cd0e4680e4aa45bd91d1bff4cb60ff6c7c3afe5ff954645507eacb1cb1114b85b21e960ac5690ea4072cad45b6c6caf389baacad5b
  • SSDEEP 393216:4uB6Mfi5GK7Zff+Vi6EEEW+WruXqu4FGZo0Uz0jUgsJ/NxlJELhwwjvm3DzXGMHM:4poQYdEE2WuX6FGZo0Uz+UgslNHJwWwq
  • TLSH
    T17227334A77A4C98BD24B3B3909D5F7B462AC1FD13B15C35A88F6AC83BC52AC6BD144D0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionsalatstealerpyinstallerspywarestealertrojanupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3