blankgrabber | 1136f4b6ae586049ce814f089fe9e6f2347f041606a4dc763f3c3056fb692ed1

General

Target

1136f4b6ae586049ce814f089fe9e6f2347f041606a4dc763f3c3056fb692ed1.zip
Size

27.0MB
Sample

241218-cpjtdaykcw
MD5

2e098fb855af6870024d1d87e01736dd
SHA1

62be3c6384a5653033e505d0e5e4db3047371ea0
SHA256

1136f4b6ae586049ce814f089fe9e6f2347f041606a4dc763f3c3056fb692ed1
SHA512

e546d78b1f54757784657ef62e77a508f1f08caa4ebe85f11547b015dcd7d4ecfd49a03523ca2299e64b6415b4b26627237d9092e8ba19e43bddbbee1a6ecf16
SSDEEP

786432:PVliLeGczvUKs0Oie4fYHSBTWEw4nE8EEqhE:HVG5D064PTWAfwE

Score

10^/10

Malware Config

Targets

- Target
  
  mains-main/Java.exe
- Size
  
  7.7MB
- MD5
  
  e986bc7d990ae823663fed0431fbf9d4
- SHA1
  
  cf38be98339624451546b6a1f64c8aaa92b6ba0b
- SHA256
  
  535058a630b1d9fb40eedf40c77497652e32a0fabcdb077022118e3d159c1ff8
- SHA512
  
  02019f314a411f64fb704c7edf0fecc23487cc2a5aae92b392ac1b40036a247d3cd2252ef55b1bbd65ba7a6585aacad004583f156cd96c9fa68f36c2aa36a95d
- SSDEEP
  
  196608:VE0SieNTfm/pf+xk4dNSESRGtrbWOjgWyS:My/pWu4m5RGtrbvMWyS
Score

8^/10

upx collection credential_access defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  mains-main/Java.jar
- Size
  
  20.1MB
- MD5
  
  35104d7c2b898e95d2376dae16480947
- SHA1
  
  63e5393576254cf8f0a2bc98c685a42725ae5816
- SHA256
  
  214e9a22cfc442496b56584cc6fc8127a36b647652d532c67c091c1bd546a3a7
- SHA512
  
  778222e37dd395850a65d30ffd4e9818b6fd9b381d3dbae0e66585ad2f2785e908938dfadbc3c4ef83652c59d407697a27c9a33fb973ef0e8435aa07c31e1b98
- SSDEEP
  
  393216:2ypV3BNHWn22TgCWb+S0wjCeZqz7tCJXh9Qmw73gCcwzadJovsXWeGN+DA:2eFQ2rGSfCtCJXTqzgCcwz2oEXU
Score

1^/10
behavioral3 behavioral4
- Target
  
  mains-main/Javadsadsa.exe
- Size
  
  2B
- MD5
  
  81051bcc2cf1bedf378224b0a93e2877
- SHA1
  
  ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA256
  
  7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- SHA512
  
  1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
Score

1^/10
behavioral5 behavioral6