blankgrabber | d3e31e51245e3f11ef86da0eaa102d42bff525e431fa51543eade45f2d191576

General

Target

open if you like men.exe
Size

20.0MB
Sample

240817-lsavbasdql
MD5

9e957472e1e7d9b1dad366514751b366
SHA1

6446b56a27f02db737946313b65b35da0dd8e67b
SHA256

d3e31e51245e3f11ef86da0eaa102d42bff525e431fa51543eade45f2d191576
SHA512

79382db19e9ad61e33320c32297f04839a18998b2012566ae58817a6ceb63ee1363d192f25833097a2707a6bffb894c7389181c6b8e90d64ed317c1fcdf03978
SSDEEP

98304:SHeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbBv9JTSPhlVtQo1fY:S+YmOshoKMuIkhVastRL5Di3tKBSPJY

Score

10^/10

Malware Config

Targets

- Target
  
  open if you like men.exe
- Size
  
  20.0MB
- MD5
  
  9e957472e1e7d9b1dad366514751b366
- SHA1
  
  6446b56a27f02db737946313b65b35da0dd8e67b
- SHA256
  
  d3e31e51245e3f11ef86da0eaa102d42bff525e431fa51543eade45f2d191576
- SHA512
  
  79382db19e9ad61e33320c32297f04839a18998b2012566ae58817a6ceb63ee1363d192f25833097a2707a6bffb894c7389181c6b8e90d64ed317c1fcdf03978
- SSDEEP
  
  98304:SHeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbBv9JTSPhlVtQo1fY:S+YmOshoKMuIkhVastRL5Di3tKBSPJY
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1