blankgrabber | f26b7a4ccbf395693ad089998eb038cb01f22a6b993f670f9bddeea676758440

General

Target

gen steam.roblox.rar
Size

7.3MB
Sample

241128-x41qnasqfp
MD5

fe7bef1e96a249efe61c805f99f5879b
SHA1

5794822917607cb40a05d5cad09fcfe84333735d
SHA256

f26b7a4ccbf395693ad089998eb038cb01f22a6b993f670f9bddeea676758440
SHA512

d6cb2f8f51fe9128d879b6ab06bb0fc0e505618adbf3678bcb849bac7a41f0c884b22046cc407a704894c6d5014b18790afbcb85e6a85d6b867de6f696ddd310
SSDEEP

196608:gVOdDM5sCiHyQJhgGOjf5fOXHlOHHSXmiRS6lwLJoQoG4wFq:gEdDMsCRQJhgDjBs2HeS6ynonwQ

Score

10^/10

Malware Config

Targets

- Target
  
  gen steam.roblox/License-.rtf
- Size
  
  192B
- MD5
  
  048f563e590dcebfbd85bf3728df3791
- SHA1
  
  fe00a008f6d95dc14a84578045197d25c1f97616
- SHA256
  
  da1cd38070db8e4c12643ed6007be206c26392f47e8d5a898937f9379d2aae01
- SHA512
  
  47ed4377afe15774dc2ef327858f2f28a0f17ae1e68bddc57898fc4b3654e98402ea8bed5f63342fa9d6f6b227a2f7fd6ccd601e59f5ee6132b4c4d8830b6d0f
Score

1^/10
behavioral1
- Target
  
  gen steam.roblox/gen-(1).exe
- Size
  
  7.4MB
- MD5
  
  ccf3d3e9e629990d4dcfa3fec7f3ec1e
- SHA1
  
  479f853bf161ddff64a044b486d70e96654c923e
- SHA256
  
  f332235072e8ab37ec7c472f04e1d919be8a841cdc7bc3c3a19f1deb0ad2d700
- SHA512
  
  83a0458a3ebbf70b26e2e3324c836cc2b82748b2a17e195334b4a31a43ee0c35a288eb2e375cf440564ad9ba78f9d908ff178290354207a004ee98899776863d
- SSDEEP
  
  98304:wGSi8TR8WnurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EwKhOh112mY:wBcgurErvI9pWjgfPvzm6gsFEF4fC
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  ��O��.pyc
- Size
  
  1KB
- MD5
  
  a267671584446b6f2ef7c85437f232af
- SHA1
  
  4ce442c13b238b371947bb4dfbbd7be95f676fc6
- SHA256
  
  dbd92fb4f366a774879576c4c7efd2d8ddb9a25fb854680ff291c26175ef8fc6
- SHA512
  
  47fd04dd2c5a2d67ea133739a9243e7ca91609259a86dbce4706aea737d48a96ac5eec37c5838f99f41256f9818f4969b406f183547b5781910e72f8cf2176c3
Score

1^/10
behavioral3
- Target
  
  gen steam.roblox/secret.txt
- Size
  
  64B
- MD5
  
  5a799bd4d528cded12b143dee91659ec
- SHA1
  
  97c0fa7efc23514d5f7ad98db8c96f50fdcb580e
- SHA256
  
  8b1cc8e0744dca5fada8cf95e4d88b4cd769a99757351b82a14d333e2e515115
- SHA512
  
  9dc335c69f77519f1593c2d1cadfdebcfefcce8766ee95ce647eccf25320d45bbcce39d79216b8b5073939ca0596103fd8bead7992d966bfd693231d4682c9c9
Score

1^/10
behavioral4