blankgrabber | 61f63f2608d21e17b622e914039bc49ea851491505ac6f8b2082f0afadd63929

Sharing

General

Target

ProxyChecker.rar
Size

18.6MB
Sample

241205-jttmpsvqgv
MD5

7a9e72827674badb6d6cc2969597d6d3
SHA1

ad74996228438bb4e49fcaedd6eff2d7e12930bb
SHA256

61f63f2608d21e17b622e914039bc49ea851491505ac6f8b2082f0afadd63929
SHA512

72c51d759b294d00040759a84e7834f8250c345b5e75ff467975456ef21e6ef09699440f2eedf47516535be80ac7411cbc869193c337af599d50aa38730f7f16
SSDEEP

393216:1lkDymXGmT7DnRuyHDy099Q3X/IZDpR8VRCEU3kRlalcm8kmf:1dc7DnoyHDy09i3XgTKC30jw/w

Score

10^/10

Malware Config

Targets

- Target
  
  Valid8Proxy/Data/Jint.dll
- Size
  
  244KB
- MD5
  
  734c5ce8f9b104d8ad3c7b494e96f9b9
- SHA1
  
  184cd4152b1b65d9531867b06c2e1c215fb872f1
- SHA256
  
  ed618668ae9e7c02c7c2b7332dd09079168cca96432a051044683c996337001c
- SHA512
  
  1e3ac0649e3b7bf9e97681aa7b1346aa44afe96d8c86fc77a6e002b8cf5b14b1a57f19f669ed0d4ae9a94d3f65d4eefa99dcffcf5d74afc8731f913c9c9f79d6
- SSDEEP
  
  3072:hE1DupDOGfyKkpsZa27k5t0f5jjBWV239UDjRFAkqYL36ZmvYYGUaKTUCRaikNrJ:hjyQlGunmvjPa2vRQrXPHNQHsq5+L
Score

1^/10
behavioral1 behavioral2
- Target
  
  Valid8Proxy/Data/Leaf.xNet.dll
- Size
  
  142KB
- MD5
  
  2c607159e31c1e091697e74efa5cfebe
- SHA1
  
  874d28447e5c1d7583f413db85049bf17de830b5
- SHA256
  
  056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec
- SHA512
  
  bfe7b463db8f0ef5981b4cdf22d2815ec10a941fb7cdeff4a861626f1fa9a29f913c5e971b257a5d206965e1300328b7530c40692889d9065ab95d63a63fe55c
- SSDEEP
  
  3072:iKpUZ/x+t38Q4I2T4EFWX66sU9/dfYJd:vUZ/x+tMnI2T4/XN
Score

1^/10
behavioral3 behavioral4
- Target
  
  Valid8Proxy/Data/Modules/Checker.exe
- Size
  
  6.0MB
- MD5
  
  7b23b16fb9cb368b3b282f96d5067229
- SHA1
  
  0393a31b074ce29a904e97929da620d3a2bc9f89
- SHA256
  
  7e55049a20a923847008b11dd7c0886ab0b88bc9cf612fd4548191453c4fc5c9
- SHA512
  
  57bc40d31995d451c1600de88e5f3c20253e63f248251033d2f92ab9d415c6d648ef4f1025e810ef7f561e7a45be6746de7a78da9a91467329145b6a40f0d8cf
- SSDEEP
  
  98304:r75PmoDUN43WlmljOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a5tMu:H5PumWMOjmFwDRxtYSHdK34kdai7bN3A
Score

8^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  
  Valid8Proxy/Data/Modules/Checker1.exe
- Size
  
  12.1MB
- MD5
  
  c80d62ea9392b55404d34513ea87aac8
- SHA1
  
  47fbed6b45f7ec59f64f2328cb5c2397102fcbf2
- SHA256
  
  0ec753374174c21ad50f39c68611bab1fc687c8359c2fe8d5cdb24c9c859fa77
- SHA512
  
  3f9a47489b66e8f9a093b69bbd7a4d3a4793fcab24a48a86233244b4a7204a7eaa4b0e93078632b4131f7275970189b7aeb41bc395a9798ce989b63f949c6511
- SSDEEP
  
  196608:99EaY7HakrIK63UtauZijIXMCHGLLc54i1wN+gPIcu9KYK39shSEo3PPyIkMeKOO:IPae63hucsXMCHWUjvcuId9/PyjrF
Score

7^/10
- Loads dropped DLL
behavioral7 behavioral8
- Target
  
  Valid8Proxy/Data/Modules/Jint.dll
- Size
  
  244KB
- MD5
  
  734c5ce8f9b104d8ad3c7b494e96f9b9
- SHA1
  
  184cd4152b1b65d9531867b06c2e1c215fb872f1
- SHA256
  
  ed618668ae9e7c02c7c2b7332dd09079168cca96432a051044683c996337001c
- SHA512
  
  1e3ac0649e3b7bf9e97681aa7b1346aa44afe96d8c86fc77a6e002b8cf5b14b1a57f19f669ed0d4ae9a94d3f65d4eefa99dcffcf5d74afc8731f913c9c9f79d6
- SSDEEP
  
  3072:hE1DupDOGfyKkpsZa27k5t0f5jjBWV239UDjRFAkqYL36ZmvYYGUaKTUCRaikNrJ:hjyQlGunmvjPa2vRQrXPHNQHsq5+L
Score

1^/10
behavioral10 behavioral9
- Target
  
  Valid8Proxy/Data/Modules/Leaf.xNet.dll
- Size
  
  142KB
- MD5
  
  2c607159e31c1e091697e74efa5cfebe
- SHA1
  
  874d28447e5c1d7583f413db85049bf17de830b5
- SHA256
  
  056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec
- SHA512
  
  bfe7b463db8f0ef5981b4cdf22d2815ec10a941fb7cdeff4a861626f1fa9a29f913c5e971b257a5d206965e1300328b7530c40692889d9065ab95d63a63fe55c
- SSDEEP
  
  3072:iKpUZ/x+t38Q4I2T4EFWX66sU9/dfYJd:vUZ/x+tMnI2T4/XN
Score

1^/10
behavioral11 behavioral12
- Target
  
  Valid8Proxy/Data/Modules/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  715a1fbee4665e99e859eda667fe8034
- SHA1
  
  e13c6e4210043c4976dcdc447ea2b32854f70cc6
- SHA256
  
  c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
- SHA512
  
  bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
- SSDEEP
  
  12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
Score

1^/10
behavioral13 behavioral14
- Target
  
  Valid8Proxy/Data/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  715a1fbee4665e99e859eda667fe8034
- SHA1
  
  e13c6e4210043c4976dcdc447ea2b32854f70cc6
- SHA256
  
  c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
- SHA512
  
  bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
- SSDEEP
  
  12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
Score

1^/10
behavioral15 behavioral16
- Target
  
  Valid8Proxy/Hotmail Checker.exe
- Size
  
  582KB
- MD5
  
  82c493c58ad0ed2255d1500840d1d75c
- SHA1
  
  24b2997983add8d90e896af2dbdc32cf19895389
- SHA256
  
  325a912d9f9f4878cfc13a45a2da2494b4c4080c39d8a40166eb39c6ef3d24a0
- SHA512
  
  68f91fe3693dffdaadf28ad5dd3719cdfddff6e4729f48774ae336aef97908d8bc2c419aff65a7d4cbe24e2b85ea2f311dfec2de1136ed7fd7374d2d3ead8c88
- SSDEEP
  
  6144:oOaTmuaJ0GFRabVg8O1lFrRawLmKx85EJXlkc3rNPWyXJJy1LDR6qwYelXN1C4q1:oOSmvFobVgZtCKZX97NPWyXgteYILQ
Score

8^/10

discovery upx collection credential_access defense_evasion execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18