blankgrabber | 85fd4b44dd122980c70527844e1a06204ca6c0f8204a01521b07f9bd22808da5

General

Target

Built.exe
Size

8.2MB
Sample

240907-pr7z7svgjm
MD5

faf15fee0fb1ca98d1a7b038d021cd5c
SHA1

662d82cc2090b09b0337d48ac07d4235b7b3fda6
SHA256

85fd4b44dd122980c70527844e1a06204ca6c0f8204a01521b07f9bd22808da5
SHA512

9471bb91d5811a0525c86473db9307b98d4fbb58ad0e581b27fc5475a3dc15a0c4fb5fd717a0e03067cc80a2dc58a8a86dc347d47edb3fdb706b3d750c385ec6
SSDEEP

196608:CIg8VE4wfI9jUC2gYBYv3vbW4SEx+iITx1U6n6u:28VEnIH2gYBgDWZZTnz1

Score

10^/10

Malware Config

Targets

- Target
  
  Built.exe
- Size
  
  8.2MB
- MD5
  
  faf15fee0fb1ca98d1a7b038d021cd5c
- SHA1
  
  662d82cc2090b09b0337d48ac07d4235b7b3fda6
- SHA256
  
  85fd4b44dd122980c70527844e1a06204ca6c0f8204a01521b07f9bd22808da5
- SHA512
  
  9471bb91d5811a0525c86473db9307b98d4fbb58ad0e581b27fc5475a3dc15a0c4fb5fd717a0e03067cc80a2dc58a8a86dc347d47edb3fdb706b3d750c385ec6
- SSDEEP
  
  196608:CIg8VE4wfI9jUC2gYBYv3vbW4SEx+iITx1U6n6u:28VEnIH2gYBgDWZZTnz1
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1