BlitzedGrabberV12.rar
- SHA256 06fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd
Overview
overview
10Static
static
10BlitzedGra...12.exe
windows7-x64
10BlitzedGra...12.exe
windows10-2004-x64
10BlitzedGra...OR.dll
windows7-x64
1BlitzedGra...OR.dll
windows10-2004-x64
1BlitzedGra...to.dll
windows7-x64
1BlitzedGra...to.dll
windows10-2004-x64
1BlitzedGra...on.dll
windows7-x64
1BlitzedGra...on.dll
windows10-2004-x64
1BlitzedGra...le.exe
windows7-x64
3BlitzedGra...le.exe
windows10-2004-x64
3BlitzedGra...ww.exe
windows7-x64
10BlitzedGra...ww.exe
windows10-2004-x64
10BlitzedGra...y5.exe
windows7-x64
10BlitzedGra...y5.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
600 seconds
Behavioral task
behavioral2
Sample
BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
19 signatures
600 seconds
Behavioral task
behavioral3
Sample
BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win7-20240215-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral10
Sample
BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
BlitzedGrabberV12/Resources/ww.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
600 seconds
Behavioral task
behavioral12
Sample
BlitzedGrabberV12/Resources/ww.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral13
Sample
BlitzedGrabberV12/Resources/yhyty5.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
600 seconds
Behavioral task
behavioral14
Sample
BlitzedGrabberV12/Resources/yhyty5.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
600 seconds
General
- Target BlitzedGrabberV12.rar
- Size 3.6MB
- Sample240505-qlgrhaed26
- SHA256 06fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd
- MD5 4282ce784621bf22365f21260be70e5e
- SHA1 3e743738e2ec8cc35d64ebbad99abcfde46eafe3
- SHA512 aa776cfdc39c152814a7e0e6def451454ca30fc4388dec48f3d12b1e50a0ee3925bfd2333700919b52af725cfe7ece93146ba24a9c0d2a6c0d602f7b243b77ec
- SSDEEP 98304:8IAP4hcx7zUBj8tz3b/MTraRaUTAdGW3bkzjuYAV2du1hH+QJ:MqcxzKQlL/FvA0ckz542d3QJ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- StormKitty payload 2 IoCs
resource yara_rule static1/unpack001/BlitzedGrabberV12/Resources/ww.exe family_stormkitty static1/unpack001/BlitzedGrabberV12/Resources/yhyty5.exe family_stormkitty - Stormkitty family
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/BlitzedGrabberV12/BlitzedGrabberV12.exe unpack001/BlitzedGrabberV12/Resources/APIFOR.DLL unpack001/BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll unpack001/BlitzedGrabberV12/Resources/Newtonsoft.Json.dll unpack001/BlitzedGrabberV12/Resources/UltraEmbeddable.exe unpack001/BlitzedGrabberV12/Resources/ww.exe unpack001/BlitzedGrabberV12/Resources/yhyty5.exe
File Explorer
-
BlitzedGrabberV12.rar.rar 3.6MB
-
BlitzedGrabberV12/BlitzedGrabberV12.exe.exe 926.0MB
-
BlitzedGrabberV12/README.txt1KB
-
BlitzedGrabberV12/Resources/APIFOR.DLL.dll 13KB
-
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll.dll 2.5MB
-
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll.dll 492KB
-
BlitzedGrabberV12/Resources/UltraEmbeddable.exe.exe 465KB
-
BlitzedGrabberV12/Resources/ww.exe.exe 59KB
-
BlitzedGrabberV12/Resources/yhyty5.exe.exe 59KB
BlitzedGrabberV12/BlitzedGrabberV12.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eacf04d721fe4880dc73790ccbd58acf310dc0c90b13b7424200a9aa2b94640a
- MD5 930b3bbbaa989db448d8ec5c696a5a16
- SHA1 a27e7c76990a31f1414d429e828c81e14f48a00a
- SHA512 cb9dc7db9f4a4c0dc5407d0a9bbd5c1301d5c4d03fed7d6b972c61a816c8860aff072f1515189d21b3336448a7c19d99f636cc3b060e4628c2ef7dbd1e75291a
- SSDEEP 49152:KUAHP06/eyShf+okdWtRAOk3HQ7JTDCgV4L6uzxGiWaUKU:WmBf2dWtnGcDnMjFWxK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2237790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/README.txt
- SHA256 97b778580fd7487beb8062a777a654b718a3b16622d8bcf46594ac9048dd3e6a
- MD5 110a464be52a150056f184348f09a6c6
- SHA1 c7516032dbae3d9e3c0342da0bd690318b93be6f
- SHA512 04c97df944b110f6c481f2b06b406d7ba5b2b3a6176a2527ae8b9820d925a341fd106e20dd3694353effa4f623c8eeb3f858de478ebc13fa6c68d6ab04db85cf
- MD5 SHA1 SHA512
BlitzedGrabberV12/Resources/APIFOR.DLL
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e47ab6fb21bd8943f63d79387533abac0c2bd98245546df44c4f333d8013c4de
- MD5 91b4d211faddb0ebc64fb000d75d96c1
- SHA1 ba496c122f8e562ff0a4fb272a68f0b9e7bf0a3c
- SHA512 3f16b0b4618d446d0e42ed2063c611b4ffa72a5b0ff438df5286a216167881737e65d494aa12186e511690eaca2f51c00889c9eae5ab6392c1edf885e5592919
- SSDEEP 192:NVjzYtxJYPX7OdfdnHpZt8kit/2Y3ciPYEC3qHa:NVgbkXK5NHpZikit/NYE4qHa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5530dff976bc0c889076b97ca695bdb97ef07f63449d32f893ed32398ed8bfe6
- MD5 3551343fab213740bbb022e3a6dcf27b
- SHA1 de67fb4f9d58db4a860a703c8d1f54ff00ff9b1f
- SHA512 e90f51053e1d4b0ea1f7458229de92174abf0781c766290da4de5cc8dfcfb730998252bf28b36ca5070978fdcea8b97f0aea6a47b875dd34173643ac0cb46c42
- SSDEEP 49152:3CTzhVM0AU5d3UOhq8hmReOUJfd5T3D+VTQlgQeCKbu9kQLO0:GwU5d3vhzhmoOmfd5rqX0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2567326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78bedd9fce877a71a8d8ff9a813662d8248361e46705c4ef7afc61d440ff2eeb
- MD5 5e02ddaf3b02e43e532fc6a52b04d14b
- SHA1 67f0bd5cfa3824860626b6b3fff37dc89e305cec
- SHA512 38720cacbb169dfc448deef86af973eafefa19eaeb48c55c58091c9d6a8b12a1f90148c287faaaa01326ec47143969ad1b54ee2b81018e1de0b83350dc418d1c
- SSDEEP 12288:axrplPT3qwNBC3wl1zVh0Yg0pJy/qleTpfZLQ0so/VHjh:a1plPGwNBC3UOwVeLQ0so/VH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
509646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Development\Releases\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
490KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/Resources/UltraEmbeddable.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e5c9880090d757207a5cd373f5e1d20c42d7486c742b3a30a2ee741a7aef5ef8
- MD5 b6b77d0798d39d7fadd69784c4e47c30
- SHA1 967af699bd9e0f2f20b0743323e5cdd6c3767ea2
- SHA512 5140dcebbeb53c8e74364de824d78d6c5fddcfa08f0ac38ff0d898e71bf4f8630f3b529571a7f64be00981e83af7f85a9b6665aedfaf7f0720995fae8a8e28d6
- SSDEEP 12288:MXUNgkAIMflOWTUpGY5ObqRKd6G2nHVxxd/2KO:QUNdJMNOWTUQveYd6fHnxsKO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
470030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
451KB
Virtual Size
451KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/Resources/ww.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 809236959232884def77d8da2aa283a8ad4c77824932cd06a4188a21a6581bc3
- MD5 21d2cd5e50a4fea2868725cbf2bd43dd
- SHA1 2eede1b89427f9cf5b9c144f9ab2cac79439e029
- SHA512 1eacde6ef8c47fe8f6b1d6b8479453fbddd4531fb4dc3bec83eaaa261b5ae3ed963c6d862b4e92862aefa4bc069c5a190390df6edfdfded69e0778651c1bfca8
- SSDEEP 768:bv8q4lFep7sfOCROyzDxEQK76Yt5Qb7jTIajt9K0fZOv11yL6N9gE5WHpGV:Dt4lffROyzECZ41yLg9gEgJS
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BlitzedGrabberV12/Resources/yhyty5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4e3ff2595fc8b32fb44856e856b6d91600fd6a66ab556bc2437a926bf7c8fdb0
- MD5 9b1283f4b90fa0009ea6fda13596a584
- SHA1 1daa7ccfddc6da823c2fadb7b821a9e26efebabe
- SHA512 ca6d46254da5c16f80a3ee4a5d11b7203a025082e8268ba8ff343a6b705262e03c8c149e381ec038b364ebecb8a5ab4169e6e5fb3676d90abe37aecf468d1ecb
- SSDEEP 768:uvlq4ltFkHOCROyDZSCY6LaIdB4b2iuAPGdX3oI0fZOv11cEL6N9Q5WEpGl:I84l4XROyDL3AEo41BLg9Qg6y
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ