blankgrabber | c73ab12a51453186a6a9d38fafeb81e27a80245f0d667860c60393f9e50b86dd

General

Target

InfernusTool v3.6.2.exe
Size

6.6MB
Sample

241219-vtg5fsxjgk
MD5

77e0126590495d045702aaa1c4ccef18
SHA1

37d9a93e278967834f4fdaa35a7a3ee3135b7591
SHA256

c73ab12a51453186a6a9d38fafeb81e27a80245f0d667860c60393f9e50b86dd
SHA512

bf80005769ee8dee34df57b21ae892c057d652b098dda7614b756cfad28fb1b2772f0d9844f77369fbcd33fe0134ca4ed21123b85c3d832ddf8a5c2feb01f123
SSDEEP

196608:qeWqDOYjJlpZstQoS9Hf12VKXMSExJeBwkhK:vBpGt7G/My4Je/A

Score

10^/10

Malware Config

Targets

- Target
  
  InfernusTool v3.6.2.exe
- Size
  
  6.6MB
- MD5
  
  77e0126590495d045702aaa1c4ccef18
- SHA1
  
  37d9a93e278967834f4fdaa35a7a3ee3135b7591
- SHA256
  
  c73ab12a51453186a6a9d38fafeb81e27a80245f0d667860c60393f9e50b86dd
- SHA512
  
  bf80005769ee8dee34df57b21ae892c057d652b098dda7614b756cfad28fb1b2772f0d9844f77369fbcd33fe0134ca4ed21123b85c3d832ddf8a5c2feb01f123
- SSDEEP
  
  196608:qeWqDOYjJlpZstQoS9Hf12VKXMSExJeBwkhK:vBpGt7G/My4Je/A
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx evasion
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2