blankgrabber | 6ad2e67430780fa03369f1d57ff0f023e7840990a37b5bc18530a52e052a24ba

General

Target

Razer Synapse 3 Host.zip
Size

8.2MB
Sample

241130-dph3hsyqew
MD5

31aa9013f477b59438114dcf2cb106c8
SHA1

1ab8d2d89e4b36be92eb1210c0c9d0c6c20a9ac0
SHA256

6ad2e67430780fa03369f1d57ff0f023e7840990a37b5bc18530a52e052a24ba
SHA512

13bd3b15ddc402b3d4dcf03e67679c05d31cdb15682e8b244001ef565042c118e9cadfecba96295b6c736819e3a0608f4b03f4774690ea65d71f3780a3d2aa15
SSDEEP

196608:e1yDXBMwn4v1bCXW+PjK0+jns7iP/kUpfGA7g+Q1MMuaFuxfS:eczZ4kXWmjr+jns7mcwZNQ14o

Score

10^/10

Malware Config

Targets

- Target
  
  Razer Synapse 3 Host.zip
- Size
  
  8.2MB
- MD5
  
  31aa9013f477b59438114dcf2cb106c8
- SHA1
  
  1ab8d2d89e4b36be92eb1210c0c9d0c6c20a9ac0
- SHA256
  
  6ad2e67430780fa03369f1d57ff0f023e7840990a37b5bc18530a52e052a24ba
- SHA512
  
  13bd3b15ddc402b3d4dcf03e67679c05d31cdb15682e8b244001ef565042c118e9cadfecba96295b6c736819e3a0608f4b03f4774690ea65d71f3780a3d2aa15
- SSDEEP
  
  196608:e1yDXBMwn4v1bCXW+PjK0+jns7iP/kUpfGA7g+Q1MMuaFuxfS:eczZ4kXWmjr+jns7mcwZNQ14o
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  Razer Synapse 3 Host/RazerSynapseInstaller_V1.19.0.635.exe
- Size
  
  8.4MB
- MD5
  
  ea6d73fe2f7fba7318d12626a0ab4dbb
- SHA1
  
  3b37dc8a1028e2b145d48593092852d4f0d2d2b1
- SHA256
  
  302e4adba81cfd49955664b2fdcd207a0e5da8bbbecfc1f4eb789603001c80d2
- SHA512
  
  e02c5d9ce24e916e272289826a9733c009cdda741c15fa314f39e1b63feaa070931d0365ff0defcf04969175ad8f7ddba85d07071a426158a6f60b5e066a30f6
- SSDEEP
  
  196608:1/MfYTwfI9jUCzi4H1qSiXLGVi7DMgpZASEyQ0VMwICEc/j8:yIHziK1piXLGVE4UrS0VJY
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  ��~��(v.pyc
- Size
  
  1KB
- MD5
  
  591aa1d296f1adb1506d8124bae7b3d4
- SHA1
  
  25bf54569d49ff26f17f31665c935b42e449ba85
- SHA256
  
  d38eba6f1e5f918de0f67557043c56e5d7469986a2638818d86ee7f0f676d8fb
- SHA512
  
  4def85ac669b22b5d0a1fa402165e4c01bdf80b949d9d0b7b8f99a476facee277ddbf9c575c8b71d6a20c302eb67a6b419fa2ae83e303a2b96148e30a9e27af0
Score

1^/10
behavioral3
- Target
  
  Razer Synapse 3 Host/clean.py
- Size
  
  2KB
- MD5
  
  4e777936ca7fd8fa2bae957b084a33d9
- SHA1
  
  bda7bba90b9f769b1d2ca3648831f31983e4261e
- SHA256
  
  2a6f17f9f747afd690f8134ee06cbc120d952d09a8d855214fa84e1d80e43e0e
- SHA512
  
  3c1fadc4bc7d7944a933eccd0d507127572b1b6ce1f4cf0b945134c109fe100852e8b95f6fea7066d9c773125328461a33a6569bfd750d2ad5994e76d202b65d
Score

3^/10
behavioral4