blankgrabber | a005335326d073f664b1b0c4df17827d9dbddaac3f1551ba2cdf22b6aeb1b66f

General

Target

nitro gen.exe
Size

8.3MB
Sample

240707-m3lj8szfrr
MD5

5cea1c6bcebef25c2df3940c510e1bf5
SHA1

b587695b75d26e437437a3813101dbd72c9f8837
SHA256

a005335326d073f664b1b0c4df17827d9dbddaac3f1551ba2cdf22b6aeb1b66f
SHA512

64d2a048687af97529f8522aef193a79eb99e7bbce2ca2cc55360b2c64c2020c54db4a189ad89dfe18221a0a556a9d37ce9860f61af0344c099eed2514e6067b
SSDEEP

196608:9Xs+sxfSurErvI9pWjgU1DEzx7sKL/s1tySEQAkjUWlRH2Wx:iXxfSurEUWjhEhn01tv392Wx

Score

10^/10

Malware Config

Targets

- Target
  
  nitro gen.exe
- Size
  
  8.3MB
- MD5
  
  5cea1c6bcebef25c2df3940c510e1bf5
- SHA1
  
  b587695b75d26e437437a3813101dbd72c9f8837
- SHA256
  
  a005335326d073f664b1b0c4df17827d9dbddaac3f1551ba2cdf22b6aeb1b66f
- SHA512
  
  64d2a048687af97529f8522aef193a79eb99e7bbce2ca2cc55360b2c64c2020c54db4a189ad89dfe18221a0a556a9d37ce9860f61af0344c099eed2514e6067b
- SSDEEP
  
  196608:9Xs+sxfSurErvI9pWjgU1DEzx7sKL/s1tySEQAkjUWlRH2Wx:iXxfSurEUWjhEhn01tv392Wx
Score

10^/10

evasion execution persistence upx
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1
- Target
  
  S�$��.pyc
- Size
  
  1KB
- MD5
  
  f39ec357071113e2f11d21969b2ff0ad
- SHA1
  
  caef0a51c0fbbbc928adb5906d40add7e2ed89b5
- SHA256
  
  40faad13684de40d4086a4cfe0d3300b76e772bb6840d4c7985e7c3baa7617f0
- SHA512
  
  a503e916e752bcd57a7124f03ede8d83c0ac7fa395e26b67b0b16994ad10411467503177a4681ebc35e3b4a89ff552b0b9899eba2ee37d18f1d6c5e2f052eb64
Score

1^/10
behavioral2