blankgrabber | 12875ace11516e11024c731c544e9c2ec0927394d74f58ff2a7508697509038a

General

Target

dx9ware.rar
Size

6.7MB
Sample

241004-qpwd3awerq
MD5

446744abf8d06353c59776b59637b749
SHA1

acec5264eccf1fe965a06a42b7b83cf23a00b9dc
SHA256

12875ace11516e11024c731c544e9c2ec0927394d74f58ff2a7508697509038a
SHA512

fd966c375386d92bfad5d84a282bcfb9b48d02fa2b13ac1f39c8110e1785210cb0f0e460c908bd570da9ff93bb5a500c24e1d7de94fe445f74d2def6eaa70c9d
SSDEEP

196608:R42B38106nt1kHM6FuFwU/ZAMv5xp/16et:R42d6xks6FHyH6k

Score

10^/10

Malware Config

Targets

- Target
  
  dx9ware.rar
- Size
  
  6.7MB
- MD5
  
  446744abf8d06353c59776b59637b749
- SHA1
  
  acec5264eccf1fe965a06a42b7b83cf23a00b9dc
- SHA256
  
  12875ace11516e11024c731c544e9c2ec0927394d74f58ff2a7508697509038a
- SHA512
  
  fd966c375386d92bfad5d84a282bcfb9b48d02fa2b13ac1f39c8110e1785210cb0f0e460c908bd570da9ff93bb5a500c24e1d7de94fe445f74d2def6eaa70c9d
- SSDEEP
  
  196608:R42B38106nt1kHM6FuFwU/ZAMv5xp/16et:R42d6xks6FHyH6k
Score

3^/10
behavioral1 behavioral2
- Target
  
  main/loader.exe
- Size
  
  6.8MB
- MD5
  
  778d19faa6797d8b17178812eb873638
- SHA1
  
  de7c7c2ff3be333a7ee22e7c1cf544a33c3e50a6
- SHA256
  
  46e84b940d02fd62aec006e80b56b52e5cddc86c28e16d959b4837d8b1e1f883
- SHA512
  
  db8a06e04c2642c2c5cceddb0adb8c0d131b7867b68bcc5a7625f7cdf74bcdaa298d1bf6f83d341255439eee3d1fbd4edd1a7cc6508f3929e1d44d34783b5d61
- SSDEEP
  
  98304:CgkwN+MdA5wqMr4o8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoaZDJ1n6hBnLq:CgV1gB6ylnlPzf+JiJCsmFMvNn6hVv+
Score

8^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  
  X8��%~l.pyc
- Size
  
  1KB
- MD5
  
  e4447adcee9f66207029c34242fb6834
- SHA1
  
  00d326b8a12a3fd38d46f771c87af3b30337af10
- SHA256
  
  47ef5b63aa13e951c309e7ec04c687e85d6969a5aa8b9071c2b0f6b4a524dbb9
- SHA512
  
  c8370dc2ad39d65744e08f19988e941779217c04542f39ba2e9fa6db297ec951a643be236665112b465d67749938944092329b9715b5bfdc6962024b99c54d64
Score

1^/10
behavioral5 behavioral6