Procedure examples

Snip3 has the ability to obfuscate strings using XOR encryption.

Snip3 can obfuscate strings using junk Chinese characters.

Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.

Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.

Snip3 can use a PowerShell script for second-stage execution.

Snip3 can use visual basic scripts for first-stage execution.

Snip3 has the ability to query `Win32_ComputerSystem` for system information.

Snip3 can download additional payloads from web services including Pastebin and top4top.

Snip3 can download and execute additional payloads and modules over separate communication channels.

Snip3 can download additional payloads to compromised systems.

Snip3 can decode its second-stage PowerShell script prior to execution.

Snip3 has been delivered to targets via downloads from malicious domains.

Snip3 has been executed through luring victims into clicking malicious links.

Snip3 can gain execution through the download of visual basic files.

Snip3 has the ability to detect Windows Sandbox, VMWare, or VirtualBox by querying `Win32_ComputerSystem` to extract the `Manufacturer` string.

Snip3 can execute `WScript.Sleep` to delay execution of its second stage.

Snip3 can create a VBS file in startup to persist after system restarts.

Snip3 can execute PowerShell scripts in a hidden window.

Snip3 has been delivered to victims through malicious e-mail attachments.

Snip3 has been delivered to victims through e-mail links to malicious files.