blankgrabber | addfab49b4bdc217eaf50439856f0ffd9ef812c3828f1e2467d87825c85a5750

General

Target

DA NON CLICCARE.exe
Size

7.6MB
Sample

241219-zt6j9sznfk
MD5

d2cebe6cd6b57bb9d526cb35c064b964
SHA1

42d8530de3b7e18c736f9f2c87f553ea0db3a9be
SHA256

addfab49b4bdc217eaf50439856f0ffd9ef812c3828f1e2467d87825c85a5750
SHA512

e0cf350ca538eba97537ddcfea3e265d3d112d5f9ba60f7636fcf76121fece4ccfb9dac45c75b2e541507744de0fb60ba120d45d4c89c8740134b86c10c654e6
SSDEEP

196608:82HYIwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j/:GIHziK1piXLGVE4Ue0VJj

Score

10^/10

Malware Config

Targets

- Target
  
  DA NON CLICCARE.exe
- Size
  
  7.6MB
- MD5
  
  d2cebe6cd6b57bb9d526cb35c064b964
- SHA1
  
  42d8530de3b7e18c736f9f2c87f553ea0db3a9be
- SHA256
  
  addfab49b4bdc217eaf50439856f0ffd9ef812c3828f1e2467d87825c85a5750
- SHA512
  
  e0cf350ca538eba97537ddcfea3e265d3d112d5f9ba60f7636fcf76121fece4ccfb9dac45c75b2e541507744de0fb60ba120d45d4c89c8740134b86c10c654e6
- SSDEEP
  
  196608:82HYIwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j/:GIHziK1piXLGVE4Ue0VJj
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  ��,�e.pyc
- Size
  
  1KB
- MD5
  
  5457944c8b670e12cab3c922bf10ef0b
- SHA1
  
  5b56d21f9e7c3b7808f76f8c5b7ad952b3ab10c8
- SHA256
  
  e577aab37d4f2f03f80293feb038d33accbf527aaa7050b13d90bba93a75e069
- SHA512
  
  231f4ced0cfebc7f1396addb064250bfb3f68aac1327fa5114327e578830d82af528e7770d192b24cde7e31324bedc15584c57aec5c04650e43848fd709cf320
Score

1^/10
behavioral3 behavioral4