blankgrabber | e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078

General

Target

Obekräftade 680491.crdownload
Size

7.2MB
Sample

241204-lhfmta1qax
MD5

90a58ab991bc0eb1edd154a31bcda5d2
SHA1

6de61f5326b5f150a9a4c7eea232e8e87fa70b63
SHA256

e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078
SHA512

3b9bc29b8c59d0d2eebe09beaa17ab0390a97957b9eeb7322ec253ced901db52ef0d60db0ee5d5f4a45db082b90870fa3b4bab0f22af29696e761d894b9dd595
SSDEEP

196608:OMVFkE8DSc4eokbV5C5BTDZasMKvjx9B+:OMV2E8D2eokJg5BTDP1F9E

Score

10^/10

Malware Config

Targets

- Target
  
  Obekräftade 680491.crdownload
- Size
  
  7.2MB
- MD5
  
  90a58ab991bc0eb1edd154a31bcda5d2
- SHA1
  
  6de61f5326b5f150a9a4c7eea232e8e87fa70b63
- SHA256
  
  e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078
- SHA512
  
  3b9bc29b8c59d0d2eebe09beaa17ab0390a97957b9eeb7322ec253ced901db52ef0d60db0ee5d5f4a45db082b90870fa3b4bab0f22af29696e761d894b9dd595
- SSDEEP
  
  196608:OMVFkE8DSc4eokbV5C5BTDZasMKvjx9B+:OMV2E8D2eokJg5BTDP1F9E
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  Luna-Grabber-main/Builder.exe
- Size
  
  7.3MB
- MD5
  
  a215edd9d9788492b561858e44184bca
- SHA1
  
  77d8816ecce79f525c118687149e2f3b68dcb984
- SHA256
  
  7fbbefdae9adf0f81808b9decf48c08ba4a47293e80cd4855c083ab1f392c184
- SHA512
  
  64dfdf28e74a95af3cef3ad89b45d656bb49fba705665aad7878a397f18ae1c1a7e1aca2df466e80179f130b5350f0ac1eea26affe940742c2c42b8930f035ff
- SSDEEP
  
  196608:uuWYS6uOshoKMuIkhVastRL5Di3uq1D7mW:IYShOshouIkPftRL54DRX
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2