blankgrabber | 7d1296de04f47aa306b237770040e8cc10d07b237fd32e67fdf0020d463d0068

General

Target

Built.exe
Size

6.7MB
Sample

240907-kd1azsvblm
MD5

72a6e8cb394a7ad61f792accb96283e4
SHA1

41f5d2cba54a3e2a32e46c64f231679424c7e2fb
SHA256

7d1296de04f47aa306b237770040e8cc10d07b237fd32e67fdf0020d463d0068
SHA512

9bb9aa542842d9a40a27e98b093fcf2697b05007278b0bfaeb72860b0f44d6ee42c9982416bc3c3cc001f79d82fc01dafa9a61c45623c897c0da8601f681873f
SSDEEP

196608:0LF9qeN/FJMIDJf0gsAGKXQyRzuAKYMVjOA:Ul/Fqyf0gsjCiAKZ

Score

10^/10

Malware Config

Targets

- Target
  
  Built.exe
- Size
  
  6.7MB
- MD5
  
  72a6e8cb394a7ad61f792accb96283e4
- SHA1
  
  41f5d2cba54a3e2a32e46c64f231679424c7e2fb
- SHA256
  
  7d1296de04f47aa306b237770040e8cc10d07b237fd32e67fdf0020d463d0068
- SHA512
  
  9bb9aa542842d9a40a27e98b093fcf2697b05007278b0bfaeb72860b0f44d6ee42c9982416bc3c3cc001f79d82fc01dafa9a61c45623c897c0da8601f681873f
- SSDEEP
  
  196608:0LF9qeN/FJMIDJf0gsAGKXQyRzuAKYMVjOA:Ul/Fqyf0gsjCiAKZ
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2 behavioral3