blankgrabber | e14419534d79ebd665a8680bb8a37d7aa9c62804aaa1c14d72303ec1c865e0fa | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Crubby-SetUp.exe

windows7-x64

7

Crubby-SetUp.exe

windows10-2004-x64

8

Resubmissions

11/10/2024, 12:58 UTC

241011-p7wxwayckp 10

11/10/2024, 12:56 UTC

241011-p6mmtataqh 10

Sharing

General

Target

Crubby-SetUp.exe
Size

7.6MB
Sample

241011-p6mmtataqh
MD5

e9af544eb8111fd21728de67e4f326d8
SHA1

bfaa8586a473265f291e9bb226af4680edfbe64e
SHA256

e14419534d79ebd665a8680bb8a37d7aa9c62804aaa1c14d72303ec1c865e0fa
SHA512

2745c59d4bf07313493198d6fb6578bbcc2a6c40d98fe4de78e0af3b93247d083a376136b7cb6564fd1e971ca33d2c8deb5510d9f640d8da00526b72df092e24
SSDEEP

98304:AqH+ImMcr/urErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuI/KU73bcgVowjf:AqsurErvI9pWjgyvoaYrE41JIuICox3

Score

10^/10

blankgrabber discovery execution upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Crubby-SetUp.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

Crubby-SetUp.exe

Resource

win10v2004-20241007-en

discovery execution upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  Crubby-SetUp.exe
- Size
  
  7.6MB
- MD5
  
  e9af544eb8111fd21728de67e4f326d8
- SHA1
  
  bfaa8586a473265f291e9bb226af4680edfbe64e
- SHA256
  
  e14419534d79ebd665a8680bb8a37d7aa9c62804aaa1c14d72303ec1c865e0fa
- SHA512
  
  2745c59d4bf07313493198d6fb6578bbcc2a6c40d98fe4de78e0af3b93247d083a376136b7cb6564fd1e971ca33d2c8deb5510d9f640d8da00526b72df092e24
- SSDEEP
  
  98304:AqH+ImMcr/urErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuI/KU73bcgVowjf:AqsurErvI9pWjgyvoaYrE41JIuICox3
Score

8^/10

upx discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.