blankgrabber | d8ed4b8856ae7ae313379161a477d60f1d561cf53dd560a073b8fe844f8c8344

General

Target

VALOGRAYHACKCRACKEDbyNEXTRA.exe
Size

17.4MB
Sample

240818-xpc12syfme
MD5

984dc1d56353478378a9f42895158a21
SHA1

19601c29664a559485be7cd244f49e72a6e506af
SHA256

d8ed4b8856ae7ae313379161a477d60f1d561cf53dd560a073b8fe844f8c8344
SHA512

34dc5b08d5d713cac66edd4349b546dee566073e217d4e7143712ceb5301ea134e7d7e495c5bb29c4143bd497133938a1b4e797b9a992e76514bf5cff27b611d
SSDEEP

393216:6PsbGcTDbyWQj2/780nkk6cL+9qz88Ck+7q3p91JdNqfqWg:6PennXI0n8I+9q4G331ofqWg

Score

10^/10

Malware Config

Targets

- Target
  
  VALOGRAYHACKCRACKEDbyNEXTRA.exe
- Size
  
  17.4MB
- MD5
  
  984dc1d56353478378a9f42895158a21
- SHA1
  
  19601c29664a559485be7cd244f49e72a6e506af
- SHA256
  
  d8ed4b8856ae7ae313379161a477d60f1d561cf53dd560a073b8fe844f8c8344
- SHA512
  
  34dc5b08d5d713cac66edd4349b546dee566073e217d4e7143712ceb5301ea134e7d7e495c5bb29c4143bd497133938a1b4e797b9a992e76514bf5cff27b611d
- SSDEEP
  
  393216:6PsbGcTDbyWQj2/780nkk6cL+9qz88Ck+7q3p91JdNqfqWg:6PennXI0n8I+9q4G331ofqWg
Score

9^/10

upx credential_access defense_evasion discovery execution spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2