blankgrabber | 3b55b02384a6212893042c5ac116ec1d9d56b2a007564eac049ce1e6b7cc84a1

General

Target

Pictures.rar
Size

34.6MB
Sample

241222-wa9k2avnam
MD5

d6e4e0871300d0fe0a62f419ea0e9ccc
SHA1

bde8c160f75be4c537e1645d0e1a1f6ed819876a
SHA256

3b55b02384a6212893042c5ac116ec1d9d56b2a007564eac049ce1e6b7cc84a1
SHA512

22b0a214640892a5622a9b07c0cd96a5adf33dc519baa2709438dfaa742aa05432f987108cdec1895bde06d0b436045e628ade753d1248775ee4ce7e52bba78d
SSDEEP

393216:9O5EsPm/Ph+eqQcbYX7bWYAvEpE9x2i2YYWd4A1mGDN3S0w/3qJxtDzqQkSgVk9A:8D+/VqQGNidYBR94v6JDnwwd4ygDTRlt

Score

10^/10

Malware Config

Targets

- Target
  
  BLANK-FUCKER-default/dump.py
- Size
  
  20KB
- MD5
  
  c5089787607d7498c7670323640bae98
- SHA1
  
  88ff8c77953dc3ed0dcdc3dc367eee6d28bfe579
- SHA256
  
  210d06f2c343e14ce193431f9aec912eae6381fbcdcf2d340466e68fb30cad58
- SHA512
  
  2488cab36125a40e65ecf31315051e55fd4e14c094760f804c06063019790d719f85a9120f93ce9d2068f5d0e1fb32a4b43d3e5f87ee59a7eb275c3d6e998f97
- SSDEEP
  
  384:sMVutbuVrThQDc130aK+zOUo4XQNRbz4Kpi:sMc6hQavwUo4ANxg
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  grabber.exe
- Size
  
  7.6MB
- MD5
  
  3aa246c173c3ef7f8175e480e1096e42
- SHA1
  
  9d8b0ce086352a0d3510d27a6a1581761d9d0dae
- SHA256
  
  6f10e8c6d7a3eeef45b00c1f4e359e6992efa35f8a5b58886c2e25e4725b1ea4
- SHA512
  
  d3ad017040471aaafa2a63ea8d09db09767a2c9cc23514329ac7d53cf9241511fb37410d81bea39b09874cf5617f51b6b02db7e6202620de3c2b9f09f82b9146
- SSDEEP
  
  196608:5HD+kd3wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWn:J5+IHL7HmBYXrYoaUN8
Score

8^/10

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  
  python-3.13.1-amd64.exe
- Size
  
  27.4MB
- MD5
  
  90176c0cfa29327ab08c6083dcdcc210
- SHA1
  
  cc0bcf37414be313526d63ef708fc85da3b693b1
- SHA256
  
  6b33fa9a439a86f553f9f60e538ccabc857d2f308bc77c477c04a46552ade81f
- SHA512
  
  5940aae44386f3622dee3f32e6a98073851a9f646da6bf3e04f050b9a9239e0ddf50b26e5e125154edc5bbebce7353d273950f1111e4ca5f2b4e2e4a7ac7cf92
- SSDEEP
  
  786432:fKScWFPQmn8ZNPeBvm1+MS3gpir9K8X+a:CcJQS8aBvm16gpGvX+a
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6