blankgrabber | 9ddd2984852b80fb41546e96a1c3414a55415050761a47633d28a4faeef7a3d1

Sharing

General

Target

virus.zip
Size

49.2MB
Sample

241211-w5yf9aykhp
MD5

7d68b93d4a7e51dbfdb62da3979bd11a
SHA1

47c4b9e3d564b668cffbf4519e8b1211ee97a2ab
SHA256

9ddd2984852b80fb41546e96a1c3414a55415050761a47633d28a4faeef7a3d1
SHA512

db5fe8ea5ca56c0d49ac38090015f70502ca4ef8211f3d665e0fa4335bfa28768747343aa50b57d2f5e0b8176767a0f1cb0c83b078fe2071d3d69144d7124ec4
SSDEEP

1572864:8SUiIzH6/VfA7URPNfKkEBiUA0zwunkc7QE:XTXVfHPtQiPpunlQE

Score

10^/10

Malware Config

Targets

- Target
  
  virus/FiddlerSetup.5.0.20245.10105-latest.exe
- Size
  
  4.4MB
- MD5
  
  c1980b018489df28be8809eb32519001
- SHA1
  
  e860439703d7b6665af4507b20bbef2bbb7b73f4
- SHA256
  
  588024037b1e5929b1f2a741fff52a207bcab17f0650ec7cb0cd3cb78051998d
- SHA512
  
  f70d419e869e56700a9e23350a9779f5dd56bb78adb9a1b0d5039287a24f20004db20f842294d234d4717feaa3184a5e6d90f0ee3666208bad2ea518d37b0a35
- SSDEEP
  
  98304:qMgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdA:qMoWvePjqHv72Qo96pvtF5wH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  $PLUGINSDIR/FiddlerSetup.exe
- Size
  
  4.4MB
- MD5
  
  c2a0eb6f104eacec3f39581451ee208f
- SHA1
  
  9ae7d02aeb640fbd090dfc01885b98dd5dd0b6cc
- SHA256
  
  1f926cc353301e547e76c6d2eff23fcbe85495ba0292174cc6344fac26457af8
- SHA512
  
  8b062e4f0af1dce3a12b5776646fe8c235f30de6772f579da1a6ab2bb559ed69b3bd32af95eee248c48008ddcbd40a7e49eae722a44bc9b49dd13fe38113a3ca
- SSDEEP
  
  98304:KgxyUnSAaB1eXq8yOkLiGXv72Qomw6pvtFIAwdaRdAM:KoWvePjqHv72Qo96pvtF5wHM
Score

9^/10

discovery evasion persistence privilege_escalation
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  192639861e3dc2dc5c08bb8f8c7260d5
- SHA1
  
  58d30e460609e22fa0098bc27d928b689ef9af78
- SHA256
  
  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- SHA512
  
  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP
  
  192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score

3^/10

discovery
behavioral3
- Target
  
  Analytics.dll
- Size
  
  32KB
- MD5
  
  1c2bd080b0e972a3ee1579895ea17b42
- SHA1
  
  a09454bc976b4af549a6347618f846d4c93b769b
- SHA256
  
  166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29
- SHA512
  
  946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0
- SSDEEP
  
  384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7
Score

1^/10
behavioral4
- Target
  
  Be.Windows.Forms.HexBox.dll
- Size
  
  60KB
- MD5
  
  e6f7b8c5ec4d1543eaa7f5d148c6327c
- SHA1
  
  61a5bf82b4f7da4040f76e7aec4b4b5fe0c544ec
- SHA256
  
  bbfd21490a4be96e1a44a92e39406e87978aea1fc58b603702e4e21a143dd89e
- SHA512
  
  6f4516677937f6d58d250f7b6a50f3815691f84ac17e455dd09dc6d4ecc215a8a8ea000706885c858708603223661908067ed36c037766a52d15f2eb33af1fc4
- SSDEEP
  
  1536:/KS4Z+5ZUOxinOGm7kF5Gw5qQ0DaK/nbL0LolKo4I/AhYe:T4ZkiHOGT0Dpf08Bve
Score

1^/10
behavioral5
- Target
  
  DotNetZip.dll
- Size
  
  461KB
- MD5
  
  a999d7f3807564cc816c16f862a60bbe
- SHA1
  
  1ee724daaf70c6b0083bf589674b6f6d8427544f
- SHA256
  
  8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
- SHA512
  
  6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
- SSDEEP
  
  6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
Score

1^/10
behavioral6
- Target
  
  EnableLoopback.exe
- Size
  
  82KB
- MD5
  
  81564947d42846910eec2d08310e0d25
- SHA1
  
  b7a167dcd3afb29c8a0e18c943d634e3fc58a44c
- SHA256
  
  543f16b73f7d40177585332f433ce76dddc1526e12bcd62cb73edd11eb002341
- SHA512
  
  8f06409517697b022787bc9e2ed7e73100018422177aa3f63ecb406c3bdb6b021624f909a16fca0430002bfa7d35a461b38750c79c0273a154f63316b4e13037
- SSDEEP
  
  768:AREI16zcI2eupxmhm/ljPb0O7/Al25znrShUABg4CqnZx6qmmlkoxPLabCxf1mlr:y1HLdwOLFzrShURwZoxmlkoxDtfIIM
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7
- Target
  
  ExecAction.exe
- Size
  
  19KB
- MD5
  
  519310853c0ee273a3f8787d7518dd2e
- SHA1
  
  22c4e25c4c4c2b5654d05cd6a1e737c6bcb588d8
- SHA256
  
  a23c852d3ed4148044708925e56e17246cdb88d6ecaaa375503fa1f915ba1272
- SHA512
  
  30e51202416ab2d0bac9cd294d08c12d7973e75696283b1823c6442033698f85075d14dcd79fb1f56886f4491981b1e278d3a506e5e458a1eee6bb372d5e683d
- SSDEEP
  
  192:ZsCrRJUlWDSnYe+PjPxucwwSoDvucwwfih5H0JOqxEV1a//bZ28WhTEn:GGOZnYPLxoAjo4S+JNY1cAhhY
Score

1^/10
behavioral8
- Target
  
  FSE2.exe
- Size
  
  50KB
- MD5
  
  c2fe7c92a8fc763407233203b49685f9
- SHA1
  
  d2f199e71eb7531caa71f85a679e49fa400cc401
- SHA256
  
  f55d5cb9968bcb875dc39cc84153bd52375f4cf8a680e0f5eb53a57a7e532561
- SHA512
  
  f74d29f4520ae0c9aa153f3649bdf80c1ed882a61add7267eafaecb2d036f43fc44434279e3dacd763ebc42fedc78ec3ad52a11b55d14b224b01a8bebca0f6b5
- SSDEEP
  
  768:YhiPG/qDcpEr7+zQ3Eo8P0gsH8Ufj02e0r/oEbkG3wR:ozKcy3+z7o88gsH5fjyXR
Score

3^/10

discovery
behavioral9
- Target
  
  Fiddler.exe
- Size
  
  3.5MB
- MD5
  
  87bc17f56e744e74408e6ae8bb28b724
- SHA1
  
  3aa572388083ff00a95405d34d1189c99c7ff5be
- SHA256
  
  ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057
- SHA512
  
  cbeee155c97b87a22b92b808f86fee25c18db51ab43a36b657d532d2d47d3a7db2f4507a699b72af904bf6d5ed851d1ae1fcfb4833a57096e6c7787211c0f35d
- SSDEEP
  
  49152:cbvLSgf+VOdx3Vw5+mbSgwJKI0Qpvs3c2KTn4Xj9Bh:cTmgf+VOdc5vbSgwJKDP24Rf
Score

4^/10

discovery
behavioral10
- Target
  
  ForceCPU.exe
- Size
  
  19KB
- MD5
  
  b982a103b0d4e0db856026a163124bf3
- SHA1
  
  40772be00068bbd394ff0fccd551151a822f3e70
- SHA256
  
  2d209c2b823e350c1f1661f87a3a013804302477afe56877f94adbafe7a2e06d
- SHA512
  
  214ecdf348e2093e91a489c0541f05eb3356e2531c1840a99d9f727caf1130f5041ccbc6356a7bc31fb4dece927d3fee2fa9e4689d2badbe680fd40104a9d327
- SSDEEP
  
  192:fHtIemmfltxD5WLtWwiyT5hNGnYe+PjPxucwwyibSucwwQJk35H0JOqxEV1a//bG:xD5WLZ5qnYPLxoDfoDg+JNY1cAhhv
Score

1^/10
behavioral11
- Target
  
  GA.Analytics.Monitor.dll
- Size
  
  52KB
- MD5
  
  6f9e5c4b5662c7f8d1159edcba6e7429
- SHA1
  
  c7630476a50a953dab490931b99d2a5eca96f9f6
- SHA256
  
  e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790
- SHA512
  
  78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8
- SSDEEP
  
  768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi
Score

1^/10
behavioral12
- Target
  
  ImportExport/BasicFormats.dll
- Size
  
  111KB
- MD5
  
  58a251d92731afb962b29636a887b9c7
- SHA1
  
  e54785f1804c9613b0e5b1728aee97f49b6d66ad
- SHA256
  
  28a908ac2d08de1dd2ae55edfa417ff72f535ec9207226a9ff4a0134871429f3
- SHA512
  
  4831534feba39a30e7cf86e496c41ff7661d44784aa80b6ce1562b71bc36eae38308dda46e76209b919952e5e615ab5b8ad80cc349b78522f6e87e4a45f1b421
- SSDEEP
  
  3072:T5zlHe5PmH2YVy3zhKOupG9g1rERA1Ten6V++HOHv7w:Lg/d2Z
Score

1^/10
behavioral13
- Target
  
  ImportExport/VSWebTestExport.dll
- Size
  
  44KB
- MD5
  
  03fcff4a49159e5c405420df08b37757
- SHA1
  
  89b0bc35a78f56212e53556e45d1f9039d2488d1
- SHA256
  
  5566857f213582ddca5d202bc19a1b649061437fbfd7e699afd64986fea5fb61
- SHA512
  
  8cb0d400b848d01e74a0050cdd779224d96db3b87ea393a098a5e75c52c16fd3b3bf20f49196da976af61960c865620ef82ff0295774e2e67ac5c92949c248c4
- SSDEEP
  
  768:obJ9YyrdngGT7Enn/IRXILJtGiU83aTwBmxCnF0Cxf1mlD0Z:EyEw/LtrU83aImx4fIIZ
Score

1^/10
behavioral14
- Target
  
  Inspectors/QWhale.Common.dll
- Size
  
  192KB
- MD5
  
  ac80e3ca5ec3ed77ef7f1a5648fd605a
- SHA1
  
  593077c0d921df0819d48b627d4a140967a6b9e0
- SHA256
  
  93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5
- SHA512
  
  3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159
- SSDEEP
  
  1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
Score

1^/10
behavioral15
- Target
  
  Inspectors/QWhale.Editor.dll
- Size
  
  816KB
- MD5
  
  eaa268802c633f27fcfc90fd0f986e10
- SHA1
  
  21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f
- SHA256
  
  fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54
- SHA512
  
  c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47
- SSDEEP
  
  12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
Score

1^/10
behavioral16
- Target
  
  Inspectors/QWhale.Syntax.Schemes.dll
- Size
  
  284KB
- MD5
  
  681abb88692a8d2662c527eab350744b
- SHA1
  
  58bf5fdfa668c2add65a6b7edbb43eab47648821
- SHA256
  
  9ad5749ba1914101cd4cf2736d0e74bbb8c7abbe93fd5e83377d5cbf33ddb78d
- SHA512
  
  5f2a370b4bd64e03469ddaa90b7ebd75e588033dbe48ae1b111fa537e56aa13b5bd7e067126d3cc543faf45cd0595ea2355d8fa412197b61f18754e4f9876823
- SSDEEP
  
  1536:/YiCDgqGqtbeBLmTnNLUSgk9NPOEbg0hIc2Vrl2XuPtlPpXB1sJOm8M93f2AkkgW:abMmTnNLUSgk9NPOEL2Wg1TOV
Score

1^/10
behavioral17
- Target
  
  Inspectors/QWhale.Syntax.dll
- Size
  
  228KB
- MD5
  
  3be64186e6e8ad19dc3559ee3c307070
- SHA1
  
  2f9e70e04189f6c736a3b9d0642f46208c60380a
- SHA256
  
  79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c
- SHA512
  
  7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78
- SSDEEP
  
  3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
Score

1^/10
behavioral18
- Target
  
  Inspectors/Standard.dll
- Size
  
  246KB
- MD5
  
  2f2dcf9a8bea903a95abb95808066201
- SHA1
  
  98b473a015e874638d35731710b5790fe8ec9df9
- SHA256
  
  e7f653b706f4d083d089670b8862b579f888450d3184085bc970daa3ff040012
- SHA512
  
  228f56acea5ac941dcb192775f8e8e8230c0b0e24487f135bfb5025b1a1bf64ee8cc733c44f5dcdc8eb2f63a9040e9a8ec251ec3e105f81e3007d31a15608344
- SSDEEP
  
  6144:5DdXkVTfwIyE8W+pb7fUQ/51ftYx2Ngzs2L3NUR/m1N:5DdXkiIyEV+pb7Znrxmb
Score

1^/10
behavioral19
- Target
  
  Inspectors/SyntaxView.dll
- Size
  
  68KB
- MD5
  
  49c71e4f9141cc77798718e41ec8a0d3
- SHA1
  
  84bf7e9f3a462dbbe7ee3e627a83422cf0df4d08
- SHA256
  
  9c5178b2aab92a79be9e4b31e2214d6650961b53bbdc48d952d20725e473b2fe
- SHA512
  
  ed7d35e6929670cd181a398b4c09fdf444b7eacff147a9be3bc783944e65541ebf883629fc23d6c6b642eb6719e8e9fa8a4d1c4c9ef65ba78d1ea5539f9f4843
- SSDEEP
  
  1536:KSYKCJHDFPc0WIo1zf2tr7OWzKxrCfIP:K2CRDFYIo1zfBgG/
Score

1^/10
behavioral20
- Target
  
  Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  195ffb7167db3219b217c4fd439eedd6
- SHA1
  
  1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA256
  
  e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- SHA512
  
  56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP
  
  12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
Score

1^/10
behavioral21
- Target
  
  Plugins/NetworkConnections/Telerik.NetworkConnections.Windows.dll
- Size
  
  33KB
- MD5
  
  5889357424d717c8629c8bfabcd0be50
- SHA1
  
  87e7047a40e24bd5ac23f89e072ee39a14a53023
- SHA256
  
  3564b25b24569b8d8a0128f2f4bddec89c0b8986da7542d9c64aac730360a600
- SHA512
  
  1af458742cefd4730d64b19ecc05460354f0e47a79cdcd7794877aa0f6c56cfb92f37a0daf66fedaec2a579eb0187d774b7d5ba1fff65d6ab1504df4c3668fad
- SSDEEP
  
  768:2LpjNBBUyOzcB7RZbkTg+jO4HmBWKNTjNTlfKaE:2LB9VRpOg+jmBPFjF0aE
Score

1^/10
behavioral22
- Target
  
  ScriptEditor/Analytics.dll
- Size
  
  32KB
- MD5
  
  1c2bd080b0e972a3ee1579895ea17b42
- SHA1
  
  a09454bc976b4af549a6347618f846d4c93b769b
- SHA256
  
  166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29
- SHA512
  
  946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0
- SSDEEP
  
  384:gpeCB0nVQ/EMq7+Zi9nQwnHgfLtVUEoBXejF6XFlnwnYPLYyTcGq1y2h33XcQ7:/U0VQMMrZi9QiHWtVxOFxwxGqXR7
Score

1^/10
behavioral23
- Target
  
  ScriptEditor/GA.Analytics.Monitor.dll
- Size
  
  52KB
- MD5
  
  6f9e5c4b5662c7f8d1159edcba6e7429
- SHA1
  
  c7630476a50a953dab490931b99d2a5eca96f9f6
- SHA256
  
  e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790
- SHA512
  
  78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8
- SSDEEP
  
  768:7su21mzJ3+LDDke5WcsvOvHOQ+5bQZdKXJccxYi:7qmByvke5Wcs22QRGKLi
Score

1^/10
behavioral24
- Target
  
  ScriptEditor/QWhale.Common.dll
- Size
  
  192KB
- MD5
  
  ac80e3ca5ec3ed77ef7f1a5648fd605a
- SHA1
  
  593077c0d921df0819d48b627d4a140967a6b9e0
- SHA256
  
  93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5
- SHA512
  
  3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159
- SSDEEP
  
  1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
Score

1^/10
behavioral25
- Target
  
  ScriptEditor/QWhale.Editor.dll
- Size
  
  816KB
- MD5
  
  eaa268802c633f27fcfc90fd0f986e10
- SHA1
  
  21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f
- SHA256
  
  fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54
- SHA512
  
  c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47
- SSDEEP
  
  12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
Score

1^/10
behavioral26
- Target
  
  ScriptEditor/QWhale.Syntax.Parsers.dll
- Size
  
  1.1MB
- MD5
  
  9fe6e9cfedb661c61a2c70fa75008ec3
- SHA1
  
  0f6a0f4e7fc5552088d3f2dd0c0adf6f6c45b686
- SHA256
  
  acff23204982780d844f5b0cbfe0bf1849c1dfe782cb4084ba2bdc9bf53f026c
- SHA512
  
  a8864ee43628f667d6e0acf071fbba414ff768fe9dd302e6f9498432b3ce48a22deecfe438099a3caa684ad8e9588fae111de752c37c158eebd76e48ab67e02d
- SSDEEP
  
  6144:DDsAkHPWoMvThdMlLQtRZfScxaHrlXnp55VAWvRY02OCo6+shEd2qxrGa:DDs7uounM5WSNAG2otTh
Score

1^/10
behavioral27
- Target
  
  ScriptEditor/QWhale.Syntax.dll
- Size
  
  228KB
- MD5
  
  3be64186e6e8ad19dc3559ee3c307070
- SHA1
  
  2f9e70e04189f6c736a3b9d0642f46208c60380a
- SHA256
  
  79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c
- SHA512
  
  7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78
- SSDEEP
  
  3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
Score

1^/10
behavioral28
- Target
  
  Scripts/FiddlerOrchestra.Addon.dll
- Size
  
  47KB
- MD5
  
  465761effbd26e70fb83595cb5f8a20a
- SHA1
  
  9b98750ebbc7ce144a2f8150f3b1d8201a53a2af
- SHA256
  
  38a7fa0c13d5700eec8178db2116a51c7e23d97871dbd159fb16104f91c0bfee
- SHA512
  
  063c93d8cfc0dd17d56abccb25c00c430066a117e993205ceb0161260214a104627672eaac0ea2ec6c8be488cd2056b92cf002c94c873efcf464efe35efbda7c
- SSDEEP
  
  768:h/M61OLoQSR1KWAEI086vCNVTFzQyx0yHjNbpV+5y43hDxnTxiDTxf1mlQh5VdJs:h/cBEI08WCNVT7Hjdv+hhDxn9WfI+vIz
Score

1^/10
behavioral29
- Target
  
  Scripts/FiddlerOrchestra.Connection.dll
- Size
  
  1.8MB
- MD5
  
  19d00193a0df0b4d0734d209989f594c
- SHA1
  
  1adaabf30ef7350df16b7fed023bd980809f4086
- SHA256
  
  7a041deb6934864bc3c057d1440f00e2e56104018069e57201f0fc877ef78713
- SHA512
  
  6402fa43a1b0e5a96f3270751f18be7b22774fa59a1a6737a0c1549642ef4f148765eaf30776c46f371d5dff69a164454b908ad00fc371d8bdeeddc52f7c9789
- SSDEEP
  
  49152:pkLbcPdI5jVkVyEf8qLFlBPdl7KsQ3+rLmk54aqJJd:YEPFXYzd
Score

1^/10
behavioral30
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  192639861e3dc2dc5c08bb8f8c7260d5
- SHA1
  
  58d30e460609e22fa0098bc27d928b689ef9af78
- SHA256
  
  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- SHA512
  
  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP
  
  192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score

3^/10

discovery
behavioral31
- Target
  
  virus/FrozenPerm_CRACKED.exe
- Size
  
  64.8MB
- MD5
  
  26500f10c8ceeae8d462d6a3086ab5d3
- SHA1
  
  5a61e0551ff00378c3d633170b67403e50a9d425
- SHA256
  
  a8c756a4059a6be18b3a44802403fd388d938ab33677e1a6032d1c6c7741ac0b
- SHA512
  
  b1198bd575726753782e85334a1250a1fce770cad303941048801a0ac2e70ae680076535faf0c37e19644d561b3b9cc77407c23a358872e7d1c17893eecfcf09
- SSDEEP
  
  786432:BYS6GKaTYIGiYk+KjotgDqanrcHJB5hOq29p2DrhUcVqttPemFt/W:NmijZpgHJnhOdGrKYmFt/W
Score

10^/10

xmrig collection credential_access defense_evasion discovery evasion execution miner persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral32