blankgrabber | 0206a0a9a027f424f903592488395be9980667cfd3fdb490099d781cb842cca4

General

Target

iptool.exe
Size

8.2MB
Sample

241229-zsc7bsxlek
MD5

735082e0dee0d7dda510b47b2e27cee2
SHA1

525d60e18903772d8f3e1dce46bc3bd0bc509b14
SHA256

0206a0a9a027f424f903592488395be9980667cfd3fdb490099d781cb842cca4
SHA512

3f5505efd3835d23bc92a7b06e323bd3bf533d1ac4bb5dade77182ea1d96d0b80f0c3b751e792e088ad68845f899f2bf4ec06741e8e7f455a27d4f3d4271bd22
SSDEEP

196608:gugC+wfI9jUC2gYBYv3vbW4SEB+iITm1U6fd1E2:UC1IH2gYBgDWZFTOzbJ

Score

10^/10

Malware Config

Targets

- Target
  
  iptool.exe
- Size
  
  8.2MB
- MD5
  
  735082e0dee0d7dda510b47b2e27cee2
- SHA1
  
  525d60e18903772d8f3e1dce46bc3bd0bc509b14
- SHA256
  
  0206a0a9a027f424f903592488395be9980667cfd3fdb490099d781cb842cca4
- SHA512
  
  3f5505efd3835d23bc92a7b06e323bd3bf533d1ac4bb5dade77182ea1d96d0b80f0c3b751e792e088ad68845f899f2bf4ec06741e8e7f455a27d4f3d4271bd22
- SSDEEP
  
  196608:gugC+wfI9jUC2gYBYv3vbW4SEB+iITm1U6fd1E2:UC1IH2gYBgDWZFTOzbJ
Score

10^/10

credential_access discovery evasion execution spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1