d�yN��ˁzO�F5��{��A��nN������la���D�߿*�$�����������ą^iMW�M���v���v9ҝݡ?2�Z����2�D��ҫ�S �$ذ σr�,'�m_��2�x���A�p$-�0H<,ļ�8�i2 @��K�J4H��!s����غ;0�b(�<.�t ��"�@ ���luh"{:朔�c1��N��ۿ�ʝhSƋw{��A��f����e��:���tM�J���rˢOEh�ҵ�7<Z��K�1 ��a�W����\M�Z��{�.�?�`�raO�6c1��#�z�LX*�7M�R��K���H< R�}�"�:�&y���v<�1�lR�:���K$=)�Blwba<10e�`�zI�O��� Q*�A�sr������W���x�e�m�I(<�X�{ �-'�(�QE=W�?���H��E��{�#�����З��Nz�/����k�P��^Ab���m�����LyVoB�fm�+`�̤a`����i��z�����f�QM�ц��rDpD��}H�bS���q�:�����F��������OO9�o`pV?;���;�-��;$r<��ٔf�Vi.v(��`S\�ѫ��**�阓��j�e�]{D��P([��g����ZQ��7�%�Bv��j[�yw�_4�ԫ���"O ��@]G�%NQ��V�)�y�i���xuȐq�i�i%�\R���=l���!�g����`ᵇ>��v�.�W^��+�M8� o�mK��� �S����@2_�f<��K+����=Y���jZZhOZaI��ӽ܊� )���A� c�U�d1��6���=�5p�94�G�[˃��q��xq�7�� -�W9^ذ���A���)A�G'M9�ؙ/-����13i �3�qǓ����d�]g�b��\��<f��������^�R��&�e����� �u�d Fir��o0�-� [y ]�`\Bm_��*�Ƌ��;��ʦ$}x�_� ���K+�eZ�� Y6�۴._���;�L����y��e��ɴ��Q=��K�co#��ܻuЙ�D�K�:���eL�������Sdm�p�rm���F+#���JkU��MLtA�������#���8*��62E���H3�#:�6�����xw�RBMe��UL�Kd�1�91ޛ:��K�az�Ż�mHX<�Gs���ݽ�/QI;��mtc7~IxyT��]�^�qhC�|E@�%�����Ngm�j��+��6T$�^]ސ���ك�F����tr��v8�������C��x�j- ���`(���3��^�e�&zy^bfS|n�V��!b�� O����� _Ua�� ����7����T�� �E���(6���b�����Ww*_�4l%��=o:M�>�%�;����� ����y��'IG>?7����jӞ�����K��o+0��<���F����S0��PvJ�G��3�-U����ahư<��6E��֣s�q��\����� wEzj�B9���1M��O"������OZ���:����棡!�����K,���²s)��q�1���)�߹�<T�o3%��ii� �n!<?�4x�!&,��^z�g�B=M@t_�?ù�0Qk��ϡO=�J�w����%�5� ���T�IU32s�t��*m������>�t�s�At��`_w7W,y�h$T�M�������&�)��2~��]�i%�l�d�t7�ò��,���p)�7`, ����g��Ռ������"���Ϗ��{{��G��tp6p��.Q�.6g�v��"�ύ�t�Ж˱�29�L�'�nE~���d�W���'��Դ�e��ǥ�UIB��/Or����&)�bxn�nf6ʌ�zI��r;dԥx���N���1�uh{Rl�� �K:��� �'��3tZ�����p<$�J)�F�k��$��;Ӧ&hfV��n�"�) �8�#x4����(Pl�2��Ԛ��+{��)7j*�&羛�^?���3���B8wd��0p���ջ#�O��`���d��Z���6�\ �w�8��(����)UrSfD��f��*� k<��7s� ����LʟޒX} �g�(�T%�65�%ؗ�2���i��2NB���{,�p�A��+��6�h�б>HKQ3��3Ac�nl�T�m�c�,.�����d|�<&)��z1 HJЄ`��Z �r�g ���cN�$��k��u��I�&kMI�5��7�y����&61豷\y�ݖ�������%�v:�����Em� #[z/�~�}`jb'M܈�Tc H� ���_�ƛ�j˛��l'���j+�� �:�ɵ������2��b?���HF��rr�M�!j���g����r��S�}�(s��A�������G�~��$C��D6R;C���a��CϚ��ᱧ�xM�FK:+D��M���i����ZK;t���.W�W���W�NJ�:��hp��B�$�aai,t���X��d�pk:�x%�l�T�R�wK����lq!Y�pM��a�?OA�P����s00�S'�6,��E=Ԫ��.�����C9�K+�XAG�� �� �7�F0m�$�Q��Ԣd�/�~�1�>�ѩ��+�:��#�Vz��h� ����Y��]!�`����"�f�{N��J]`�lc6��������M������/O2�Y�u��,��-'��'��V`�D�(��4j�}�;����q�z��Xa��"E�:_LMoP��̥��i��c�����_� �͎�]g[��D��-���wv��u���lB�q�W��U��Ib���t~���`}�,V+��fw�)��r�2^��Lv*~e�m�lD`,�hX�f�/*T�c��1�=�fRE!i��J���{lÁ���.���$�)�����"���N���al�X�[y <���َ{��&���}�n�{M?�'�r���l?s[26&�Bot�v*�tT��Z��xB|�4�W5ھ�W���P�0Vc�B�&W��{�.>���äM��*D��>ԪX��Ŝ��s����|(��r!����ޓ�4��s ̐}�L1�: ��������2��N��(c��@ZB�(���EС^Ȑ<n���D�� �o�-p��oS�)�<�w�g��.�W���?1�r� �
Behavioral task
behavioral1
Sample
hack_Exploit (crack)_.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
hack_Exploit (crack)_.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
2��N[��.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
2��N[��.pyc
Resource
win10v2004-20240226-en
General
-
Target
hack_Exploit (crack)_.exe
-
Size
10.3MB
-
MD5
b2b4bce402256d8e2c0c3b1acbf37b95
-
SHA1
0ab0ee029442eeec453ccdba27f02a6a8ba5aa71
-
SHA256
c520b9e0d0c8c90221ad0c01c8050282c9e1e2148f35d818f4d41cd9583eefa2
-
SHA512
416da774d97626e18b17ca01f83237ba49c308d371b5c068265df07e4cfd959bcb4f2d78fa2053bda18cc36be22c33f491829275ac1798e00b4a55413db1d005
-
SSDEEP
196608:bUAv5dnca6qpNurErvI9pWjgyvoaYrE41JIuIqoxko:Yu5NcaljurEUWjdo/H1J9oGo
Malware Config
Signatures
-
A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/2��N[��.pyc blankgrabber -
Blankgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hack_Exploit (crack)_.exe
Files
-
hack_Exploit (crack)_.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 88KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 37KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
2��N[��.pyc