blankgrabber | b2ce6494ebfffb6f8213dbb59c0907601c1bbf54ce7dc7b4ea5de68ea42ad4b9

General

Target

Built.exe
Size

5.9MB
Sample

240811-p44hjszfnm
MD5

febdd8522f6e720b87478678a851e74d
SHA1

d5efb387aa49e4624c8b587d69b5037106437c45
SHA256

b2ce6494ebfffb6f8213dbb59c0907601c1bbf54ce7dc7b4ea5de68ea42ad4b9
SHA512

1053148fa30aa331043cb3a6d364902aad6377e940c4f8a7d6042ff14ddbe5e0e3750c137cc2e97762da04b23851621f2388fa51b3442f1c55dbcbaadb3a6415
SSDEEP

98304:TM+nhjQi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeF29hGkrJLccd4:T3nkDOYjJlpZstQoS9Hf12VKXpbGCF4

Score

10^/10

Malware Config

Targets

- Target
  
  Built.exe
- Size
  
  5.9MB
- MD5
  
  febdd8522f6e720b87478678a851e74d
- SHA1
  
  d5efb387aa49e4624c8b587d69b5037106437c45
- SHA256
  
  b2ce6494ebfffb6f8213dbb59c0907601c1bbf54ce7dc7b4ea5de68ea42ad4b9
- SHA512
  
  1053148fa30aa331043cb3a6d364902aad6377e940c4f8a7d6042ff14ddbe5e0e3750c137cc2e97762da04b23851621f2388fa51b3442f1c55dbcbaadb3a6415
- SSDEEP
  
  98304:TM+nhjQi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeF29hGkrJLccd4:T3nkDOYjJlpZstQoS9Hf12VKXpbGCF4
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1