blankgrabber | 261d96817d26ca580f92e36cc3f76c95a232862e1507aaea199bf204dea2699a

General

Target

NIEVES IMG LOGGER.rar
Size

8.1MB
Sample

241127-jg48ns1kej
MD5

ccd0753decb7deca684e26fc8250c40c
SHA1

bfe2cf6498585a6a4140433d9b73a74f8d65060d
SHA256

261d96817d26ca580f92e36cc3f76c95a232862e1507aaea199bf204dea2699a
SHA512

19ce281921a257dbfa080c0230e54564863fffc1be0d11af023c9faec9cedea6a9f9b9e1249e04c2d086e0b801e69ed3f043fcc2eb1d7024b7b04dc4f0e08949
SSDEEP

196608:UD5hnXYmNg4W64TnHVuhNeVGPSjdeX2CgLHTQIE9bnBe:UDboP494xeNeMjX21bT/snk

Score

10^/10

Malware Config

Targets

- Target
  
  Nieves logger.exe
- Size
  
  8.2MB
- MD5
  
  fa3bd7cef60c36ea2ac3bcc6f0e61c17
- SHA1
  
  64880a1b435eb4dcd5a04d9f63b56755eff4afd1
- SHA256
  
  ae96e2a9ff45303355dafa810a0d107be03983c63135ddcb9a7858f8a44be049
- SHA512
  
  09ae6841dbd42216f9264fb9d58fe667c98e3d0f6fad210ccfefb548565bc8af7fa395f11ff04519dcdca26bb540ea9a6aad4575bee40def8fec783f31f9e4c2
- SSDEEP
  
  196608:/rcccEzRHRrIpLjv+bhqNVoB8Ck5c7GpNlpq41J2ySEZNkfWHio6+95Wk:ms+L+9qz88Ck+7q3p91JmN8M+95Wk
Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  r�t��b.pyc
- Size
  
  1KB
- MD5
  
  50afae5e7106d0726ee6daf8189ac8f7
- SHA1
  
  e3c490f6c5a97e4662365b6985d59128fa5d9894
- SHA256
  
  dabc57bdbbfe27255fec0ec9020d40cad878cbe84e567f490afdbb05c0b99126
- SHA512
  
  75a600865e3093f640b91abc7711db49c928f946ef251e598ea57fcf883d8d5c608f1bf17b9a8c6cad886f333f5d553f31d8fffb3be5675b7aba1d2715586322
Score

1^/10
behavioral2
- Target
  
  README.md
- Size
  
  95B
- MD5
  
  fc4e230d935744020b627556cf4b4c5f
- SHA1
  
  593f4725d8829b52c2aa45c0870f8a893df67c26
- SHA256
  
  576aa2592b9eb482eebdec430f4ff8be5b06f9025b516436b853d5fb78d9f3ca
- SHA512
  
  992863695b8c150c98a516e18d13c95374fbaefb554b32dd35e1550c477f9e4af2e35c7add2c6bae908c356d6ce0a8e809f2258da3c3f5080bce5be04de2fa10
Score

3^/10
behavioral3
- Target
  
  install requeriments easy.bat
- Size
  
  44B
- MD5
  
  5bacfeee9b44d220bef5db710ed15af3
- SHA1
  
  6c3f4f7b3dcbddb607d329c5b650a0f8db112e42
- SHA256
  
  0e017e6b26ddc2ae337b0b72ff32cfc3a4d97b8f4df5fad01036794d90d58a9a
- SHA512
  
  3e783db154de86429b1b1d3848d143170453ee64664f0adb55bc71d5e7f1c733960fceddd84354d8d9b23870c9fb2951b83ffa9c955b83fef4915e7700f25d55
Score

1^/10
behavioral4
- Target
  
  requirements.txt
- Size
  
  49B
- MD5
  
  c41525329f0b582a0b9547dceae68ded
- SHA1
  
  310900c3889464d7588fd0e7adb6dbd13cf122a4
- SHA256
  
  27e7b3df7445f0bcc86ac8c37668f80d3a4f18ccf41be9c592993e8f7eadfec4
- SHA512
  
  65bfd6c7b994915b897a1109128f0d8c50d962c3082dbaccd0dcb10e82259923dc07c65f6c6063794fe5b3961f58cd98a70196b690a45fc6d7b00a9b10c0d1c8
Score

3^/10
behavioral5