blankgrabber | bf956225313453a174363ab26e59c7a6bd7907bf0921c6d690cc22bb50944b79

General

Target

banlist v1.rar
Size

8.0MB
Sample

240807-2vlycszaka
MD5

8be8d051c6b70ceaa1dfb06a23dfb47e
SHA1

9592d870ea0b86008052e8b94f2dfc9949d2512b
SHA256

bf956225313453a174363ab26e59c7a6bd7907bf0921c6d690cc22bb50944b79
SHA512

61ecc7b342749e5eaf361f771643356407e5f5bda7e5dd273e065b1475942caed61169785172d6959faf284a358fa35c1aff0618261c43190f70a0a249a028f7
SSDEEP

196608:oJUq4QPPzp4G7SlI2+hkI7HiAfhz+CYrbylFBZgPv1oXa1jyD4eT:oJUToPt4G7MIz+CiAfhz+CEAFBCVoXaw

Score

10^/10

Malware Config

Targets

- Target
  
  banlist v1.rar
- Size
  
  8.0MB
- MD5
  
  8be8d051c6b70ceaa1dfb06a23dfb47e
- SHA1
  
  9592d870ea0b86008052e8b94f2dfc9949d2512b
- SHA256
  
  bf956225313453a174363ab26e59c7a6bd7907bf0921c6d690cc22bb50944b79
- SHA512
  
  61ecc7b342749e5eaf361f771643356407e5f5bda7e5dd273e065b1475942caed61169785172d6959faf284a358fa35c1aff0618261c43190f70a0a249a028f7
- SSDEEP
  
  196608:oJUq4QPPzp4G7SlI2+hkI7HiAfhz+CYrbylFBZgPv1oXa1jyD4eT:oJUToPt4G7MIz+CiAfhz+CEAFBCVoXaw
Score

3^/10
behavioral1
- Target
  
  chetto (executor).exe
- Size
  
  8.2MB
- MD5
  
  46565d5febe93f0e3a336c1f239c86b3
- SHA1
  
  675348c8069e0690e25a56b921929ee71bc94038
- SHA256
  
  08ad5ce7a34cdcafe434ac068197e76fb7c0961300bbeb16239c29a0d5cc545f
- SHA512
  
  cef3fc5c06b38d980b92ea0489a541e37b1d155e18887f48119c8182c00937c6f900be7cde001b8b21f073c85af5b26e0ab0b7cc556315fa68b0a18759c75eb9
- SSDEEP
  
  196608:SzFQXwuLRurErvI9pWjgN3ZdahF0pbH1AYSEp1CtQsNI/SBmUM:+6urEUWjqeWxQX6nWvM
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral2
- Target
  
  tf��1.pyc
- Size
  
  1KB
- MD5
  
  e33cee2bac7b4a57476ba793ba664f6e
- SHA1
  
  063629b9690fecf8b4e5fcc1863184df751c25f1
- SHA256
  
  b871b99d8a6ecf1afe86e64f6fa82b4293d6ac2f15dc7b731a6f28f6d833f353
- SHA512
  
  39ce09e5eaf1810447f7dae37b75c2f52677909f7c3395c89e3c4b8638583cfac58726f28c2a2b9abff6bb8a2ec3f18dddf4ee8903517261abb237b4cf31e4cf
Score

1^/10
behavioral3