blankgrabber | 61f63f2608d21e17b622e914039bc49ea851491505ac6f8b2082f0afadd63929

General

Target

ProxyChecker.rar
Size

18.6MB
Sample

241205-jm914svnew
MD5

7a9e72827674badb6d6cc2969597d6d3
SHA1

ad74996228438bb4e49fcaedd6eff2d7e12930bb
SHA256

61f63f2608d21e17b622e914039bc49ea851491505ac6f8b2082f0afadd63929
SHA512

72c51d759b294d00040759a84e7834f8250c345b5e75ff467975456ef21e6ef09699440f2eedf47516535be80ac7411cbc869193c337af599d50aa38730f7f16
SSDEEP

393216:1lkDymXGmT7DnRuyHDy099Q3X/IZDpR8VRCEU3kRlalcm8kmf:1dc7DnoyHDy09i3XgTKC30jw/w

Score

10^/10

Malware Config

Targets

- Target
  
  Valid8Proxy/Data/Modules/Checker.exe
- Size
  
  6.0MB
- MD5
  
  7b23b16fb9cb368b3b282f96d5067229
- SHA1
  
  0393a31b074ce29a904e97929da620d3a2bc9f89
- SHA256
  
  7e55049a20a923847008b11dd7c0886ab0b88bc9cf612fd4548191453c4fc5c9
- SHA512
  
  57bc40d31995d451c1600de88e5f3c20253e63f248251033d2f92ab9d415c6d648ef4f1025e810ef7f561e7a45be6746de7a78da9a91467329145b6a40f0d8cf
- SSDEEP
  
  98304:r75PmoDUN43WlmljOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a5tMu:H5PumWMOjmFwDRxtYSHdK34kdai7bN3A
Score

8^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  Valid8Proxy/Data/Modules/Checker1.exe
- Size
  
  12.1MB
- MD5
  
  c80d62ea9392b55404d34513ea87aac8
- SHA1
  
  47fbed6b45f7ec59f64f2328cb5c2397102fcbf2
- SHA256
  
  0ec753374174c21ad50f39c68611bab1fc687c8359c2fe8d5cdb24c9c859fa77
- SHA512
  
  3f9a47489b66e8f9a093b69bbd7a4d3a4793fcab24a48a86233244b4a7204a7eaa4b0e93078632b4131f7275970189b7aeb41bc395a9798ce989b63f949c6511
- SSDEEP
  
  196608:99EaY7HakrIK63UtauZijIXMCHGLLc54i1wN+gPIcu9KYK39shSEo3PPyIkMeKOO:IPae63hucsXMCHWUjvcuId9/PyjrF
Score

7^/10
- Loads dropped DLL
behavioral3 behavioral4
- Target
  
  Valid8Proxy/Hotmail Checker.exe
- Size
  
  582KB
- MD5
  
  82c493c58ad0ed2255d1500840d1d75c
- SHA1
  
  24b2997983add8d90e896af2dbdc32cf19895389
- SHA256
  
  325a912d9f9f4878cfc13a45a2da2494b4c4080c39d8a40166eb39c6ef3d24a0
- SHA512
  
  68f91fe3693dffdaadf28ad5dd3719cdfddff6e4729f48774ae336aef97908d8bc2c419aff65a7d4cbe24e2b85ea2f311dfec2de1136ed7fd7374d2d3ead8c88
- SSDEEP
  
  6144:oOaTmuaJ0GFRabVg8O1lFrRawLmKx85EJXlkc3rNPWyXJJy1LDR6qwYelXN1C4q1:oOSmvFobVgZtCKZX97NPWyXgteYILQ
Score

8^/10

discovery upx collection credential_access defense_evasion execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6