blankgrabber | 92be4782cfbf57777e7cc5c500782a540dcdd84e495846bcb805642af85be1da

General

Target

downloading.zip
Size

92.7MB
Sample

240921-z8tt1svbmh
MD5

465ebdac6c1f48491ab389d0339aa8c0
SHA1

a6c3cb453fd127e3a01f0cca2246d0e58abc82ea
SHA256

92be4782cfbf57777e7cc5c500782a540dcdd84e495846bcb805642af85be1da
SHA512

19b4a069bec4575214f5d2b183f9eacc95fa897383e25bfac1e43d8f0834a81b57270c4dc645bafcb6d3f227f7cc0c0a7c0df1cc844ee949e10117e2c973177b
SSDEEP

1572864:Pgds9WuiPwk7nz7erPt6NHgBzsPy7Xgaib7oMuUcqf6uZQ6cKpqqYajqLLgds9WX:+s0uXk7nz2PagBz5zuXSUcqzxccqgj46

Score

10^/10

Malware Config

Targets

- Target
  
  BoostraperV3.exe
- Size
  
  8.5MB
- MD5
  
  713bc1e62e0c4621a8ee9da1f1a13284
- SHA1
  
  d728832a589bf5d56c60d5448b0e767e215f9055
- SHA256
  
  06af71186ea86ed3c9509f0ac0493a7dd3a51d920c777a690b404429e7fc411e
- SHA512
  
  a3ac7751ac97861255b351526d29af92e92a512c88987505ca32be43fe001fe1b5afa6c69e2c1ce11877ae753f42723f5aaba40803ccc38f8d0be3ab05e59384
- SSDEEP
  
  196608:mJ09VuurErvI9pWjgfPvzm6gspQhE14AZ:IUcurEUWjC3zDQh04AZ
Score

9^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  Galexy_Wrapper4.41.exe
- Size
  
  76.2MB
- MD5
  
  9a9a9de3d1ca9351adaab3c130ac672e
- SHA1
  
  ab35e236a214fa35c5178e7617d8b4031e9cdb9a
- SHA256
  
  081aa6e92bc9cf6ab43d40356af8a491ff8569f9ebcd192513284b8a8fba2b2a
- SHA512
  
  b0df0729347d9c0775d5e45f3d449322c21c8c77ce60e13eb3961f6e5f439820d35d402b24f0dfd4000f2b56392ed90b3d2f00333de7502d1d7a98590c47b608
- SSDEEP
  
  1572864:5vhQ6lNW/x7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDagvZaAme:5vh1fkxPSkB05awIxTy5nMHVLteMlme
Score

9^/10

upx evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  
  downloading.exe
- Size
  
  8.5MB
- MD5
  
  713bc1e62e0c4621a8ee9da1f1a13284
- SHA1
  
  d728832a589bf5d56c60d5448b0e767e215f9055
- SHA256
  
  06af71186ea86ed3c9509f0ac0493a7dd3a51d920c777a690b404429e7fc411e
- SHA512
  
  a3ac7751ac97861255b351526d29af92e92a512c88987505ca32be43fe001fe1b5afa6c69e2c1ce11877ae753f42723f5aaba40803ccc38f8d0be3ab05e59384
- SSDEEP
  
  196608:mJ09VuurErvI9pWjgfPvzm6gspQhE14AZ:IUcurEUWjC3zDQh04AZ
Score

9^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral5 behavioral6