blankgrabber | 1f86000c8c6490ebb5bfaae96bd27e7f4dac016d214bd4628d54f5a83e90017c

General

Target

Boostrapper.exe (1).zip
Size

17.5MB
Sample

241028-xvtkzssraq
MD5

1aeef0eeb1e9f85752b7dae0cbdd66d5
SHA1

a8f835e980a92203d37e5cf048021782529728b1
SHA256

1f86000c8c6490ebb5bfaae96bd27e7f4dac016d214bd4628d54f5a83e90017c
SHA512

326bd3845d0d25ab6731249f855745f1129b54dcf6e837d66a5249f2b34e7d88288ffd8fcb50fec4f8d3ddbc4a787754599124ce8afef94d473b08b6255a4dcf
SSDEEP

393216:UruLqJhziaIbR9//C4+Xn6DhzLBPZWqCyqgrdcJS+LJ:04GzipUnyhzLBPzCO0R1

Score

10^/10

Malware Config

Targets

- Target
  
  Boostrapper.exe.bin
- Size
  
  17.6MB
- MD5
  
  f860319243343e8319375b16d519f9da
- SHA1
  
  a596d8124981a31cfd5b53b6d9d7a9910c01ac02
- SHA256
  
  1f4a3c73f9608af72d6bae65df0dcafe3ac54ca67a35128743717df663eea26a
- SHA512
  
  439d453a2033dfe484ec3b40e8c51f000c8322250becdf11a5f40c2236b439048418d959059bc46feb0fbc1d0743222c66e2e9fd725cf7346e44d0a0ca3cb5ec
- SSDEEP
  
  393216:UYghxUBc2NgznNWwX+NOaVlUsIR3y/pWu4kRatrbvMKl:Uf3i1NgFrQU3y/pW6Kl
Score

10^/10

upx exelastealer collection discovery evasion execution persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Exelastealer family
  exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2