blankgrabber | 2cbaea8e3a01a54e663d098aa41605bb5a67178f341e8f56656259d274d13a35

Sharing

General

Target

VANTA TEMP.rar
Size

8.3MB
Sample

241202-cvpltavkft
MD5

03e69d91f86543e623990c2de8bb5629
SHA1

3a2c1d731f574216fb6cc0a403a41f150d72445f
SHA256

2cbaea8e3a01a54e663d098aa41605bb5a67178f341e8f56656259d274d13a35
SHA512

ac64125c715b84a54adc5530f988afee0464392779f08d7eea1af6f3715f2f55fd226b63f5700cca4ad06e8b52fbbfa76ff1a5cab37788a46716618a72dbbbeb
SSDEEP

196608:pPkXMhRdMqBh000xC8LJItCGDi86fAJ7Ay3iMDJeV3zKs/5Ks1V6uj5:p+MNnBuBbLawGDi8IY7ANMI865euj5

Score

10^/10

Malware Config

Targets

- Target
  
  VANTA TEMP.rar
- Size
  
  8.3MB
- MD5
  
  03e69d91f86543e623990c2de8bb5629
- SHA1
  
  3a2c1d731f574216fb6cc0a403a41f150d72445f
- SHA256
  
  2cbaea8e3a01a54e663d098aa41605bb5a67178f341e8f56656259d274d13a35
- SHA512
  
  ac64125c715b84a54adc5530f988afee0464392779f08d7eea1af6f3715f2f55fd226b63f5700cca4ad06e8b52fbbfa76ff1a5cab37788a46716618a72dbbbeb
- SSDEEP
  
  196608:pPkXMhRdMqBh000xC8LJItCGDi86fAJ7Ay3iMDJeV3zKs/5Ks1V6uj5:p+MNnBuBbLawGDi8IY7ANMI865euj5
Score

10^/10

collection credential_access defense_evasion discovery execution persistence phishing privilege_escalation spyware stealer upx evasion
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3
- Target
  
  vanta perm/vanta.exe
- Size
  
  8.4MB
- MD5
  
  cbf4dc6f6a4534326092a07fac9e5b63
- SHA1
  
  c86d844ad9daed65a61bd0059c56c25596dbc093
- SHA256
  
  27d87871199cb1908ebdc0aa4d7694fd5ef967b75126e6b33a8d44661a2f937f
- SHA512
  
  5d2210bd82bbbbb1c58fbe7ed45f1b7ebd6fcf1da98344201231c09795ad255be9c8d53f57c658da20daebd6a24a74e86e71ef6bf50430163b3650ef44e689fe
- SSDEEP
  
  196608:iRuYdwfI9jUCzi4H1qSiXLGVi7DMgpZASEyQ0VMwICEc/j+:nIHziK1piXLGVE4UrS0VJC
Score

10^/10

collection credential_access defense_evasion discovery execution persistence phishing privilege_escalation spyware stealer upx evasion
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4 behavioral5 behavioral6
- Target
  
  ��O��.pyc
- Size
  
  1KB
- MD5
  
  760704f2c28a98885dd6336095f3949a
- SHA1
  
  0e35f4129e3af4d5ff7bbf84d30eeebecf3428e8
- SHA256
  
  5a513beea563ec6564576a3934030577516ae47de068887c1884b98d85ac756b
- SHA512
  
  f9020317b9408656ad91d4010f9c4d92259bb9ddf833a6b703d58715c0b3e55a4f0c1aad50dd24902f8cc0b85aa743faa0b934bdd58f9095d154b6d041d68a92
Score

1^/10
behavioral7 behavioral8 behavioral9