blankgrabber | 0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2

General

Target
matcha-version-b7eebc919e96477a.zip
Size 18.3MB
Sample241110-e31edsyqfs
SHA256 0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2
MD5 c3300222aa84a4e1d37946e95e6d3017
SHA1 c777c09abc7b6b51a7b35185ff1e15afde719577
SHA512 08feb3ca784cda55c4b2991c657e9d98b64594fa9f4acfc62541db5c0aeb7ddee65836438a372734ff1b21290a00cc50dd224f95688c36a3d2c5f9fab6cc1d59
SSDEEP 393216:J8g/BmHdfUM1f/5PaV743SRFUgmNy3z7CiXFvFiKEyJpmuZdsOC:J86mHdr5Gj/mNyD7CiJgKbmu9C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  loader.exe
- Size 6.8MB
- SHA256 46e84b940d02fd62aec006e80b56b52e5cddc86c28e16d959b4837d8b1e1f883
- MD5 778d19faa6797d8b17178812eb873638
- SHA1 de7c7c2ff3be333a7ee22e7c1cf544a33c3e50a6
- SHA512 db8a06e04c2642c2c5cceddb0adb8c0d131b7867b68bcc5a7625f7cdf74bcdaa298d1bf6f83d341255439eee3d1fbd4edd1a7cc6508f3929e1d44d34783b5d61
- SSDEEP 98304:CgkwN+MdA5wqMr4o8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoaZDJ1n6hBnLq:CgV1gB6ylnlPzf+JiJCsmFMvNn6hVv+
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  mapper/map.exe
- Size 5.2MB
- SHA256 02ac7fcef95d3d8ba108c85311412739ec680dcc84e0e6baee6a77aa2271ecff
- MD5 91b2e38c78a29587e4bc141c3f048f0e
- SHA1 720a32e02fb3e9529c193c4cc1874a74c7548146
- SHA512 f5b256a0544df654e793634a847892fe00ee412bef33bc4011e7f9d6d215ccbaf0d39270dcd832e403e95ddf109d1f643bff68e359c545837c6c17e1d9f248f8
- SSDEEP 98304:MjqhOJCjRLRWUEjzqRxOdlWb0T8hEjE+R7WFxjQFQ/WbzZC+x2wAP:MesJCjR13EavA8+8+j1RSxjQsWXZul
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  mapper/matcha-driver.sys
- Size 9KB
- SHA256 5d8f2239e861694d3f10884260160259393d56810e8cc3e6cabae4c0d077c905
- MD5 21e0a2d7d9ab804eeb1d7c71b532a681
- SHA1 2c09d54d71dfbee2eb537844078d74361e1e1dcc
- SHA512 bfd6b8f3641750bcce137111b895ad9df33d712cb7f0465d99156accdff6298715a9da5da4003e2ad2bad7867013e9be096c21733946c686b2788a679059bc08
- SSDEEP 96:xnICc5aHL+i40EzLGenSP+VSHWj7TEGMlOD+1WNBbEpDDIy:JXL+iyzLXSGVYcHg1Wvbon
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  matcha.exe
- Size 7.0MB
- SHA256 b2e7dab0b5ec3e9210e16b51c640267b4de205991e8027bee7a82e0e48413776
- MD5 cce7696bf39f612b48afe51ec7f8735b
- SHA1 7187d3d9e272044774e2624a50a3285eca82073a
- SHA512 41a43d6134a566840e7a95ddf0a3f9d9f4dc2d4276730121598c1ec3237cf67fc457b4aa1f82b5bfa4245acef52bdad0fe6ecc0a9f30a2dd4efbc7b8cf7247ae
- SSDEEP 98304:yhWoRlQjtdA7nBPKB/u8aXwSk99gtgZjwWnqQSMJ5UuJ7n+zGJoTL14nYSytUm6O:y9lQj7AFI99+GjwalrpIcSL2YSyL6/i
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6 behavioral7