blankgrabber | a3b749624977298580de701eb8e8db904d7efc146d377b248a917fb2d7d575ab

General

Target

OpenThis.exe
Size

5.8MB
Sample

240906-1q99qazclk
MD5

e100ae8e25392c5c6f06cd025451602e
SHA1

2941f70d9fc912ea1494521cfac47003baeb5a04
SHA256

a3b749624977298580de701eb8e8db904d7efc146d377b248a917fb2d7d575ab
SHA512

6d8bd3f961f266d87051499bdb8347bbe6e86234770ed709e92789c81d2b7108392428bc413503c301b135ae06d392e423f99dc00d94711abc6739a5b42f9cca
SSDEEP

98304:pDmDSuXXO8nRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nGeI:pDmDZZRHvUWvozWOxu9kXwvdbDlA03Nq

Score

10^/10

Malware Config

Targets

- Target
  
  OpenThis.exe
- Size
  
  5.8MB
- MD5
  
  e100ae8e25392c5c6f06cd025451602e
- SHA1
  
  2941f70d9fc912ea1494521cfac47003baeb5a04
- SHA256
  
  a3b749624977298580de701eb8e8db904d7efc146d377b248a917fb2d7d575ab
- SHA512
  
  6d8bd3f961f266d87051499bdb8347bbe6e86234770ed709e92789c81d2b7108392428bc413503c301b135ae06d392e423f99dc00d94711abc6739a5b42f9cca
- SSDEEP
  
  98304:pDmDSuXXO8nRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nGeI:pDmDZZRHvUWvozWOxu9kXwvdbDlA03Nq
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1