blankgrabber | 0ff7a5b5bedeac0e43dfc0779ba19d96357871631043d5b9243c24bc743c9029

General

Target

Ms Optimizer.rar
Size

7.5MB
Sample

250101-sfrevsskfq
MD5

24070930e012ed85eaecbf9cb60b2910
SHA1

abe37ec45c9387538d93f9f3f24ce212e711f204
SHA256

0ff7a5b5bedeac0e43dfc0779ba19d96357871631043d5b9243c24bc743c9029
SHA512

176a59ecf6179de7c38f1c8d3d5a1901c514087c0fa6b06b865b3c72be1cfd9c34f82d0beb727db028e14dfa2d92b687bcacaa1e59be1a8ef4fceaf02681360e
SSDEEP

196608:oyUrYorj3f/9LoEyOULkTS7ys3r3wb3IhGfLjSvx5:of9xDxULkTobuwqWv7

Score

10^/10

Malware Config

Targets

- Target
  
  Ms Optimizer.rar
- Size
  
  7.5MB
- MD5
  
  24070930e012ed85eaecbf9cb60b2910
- SHA1
  
  abe37ec45c9387538d93f9f3f24ce212e711f204
- SHA256
  
  0ff7a5b5bedeac0e43dfc0779ba19d96357871631043d5b9243c24bc743c9029
- SHA512
  
  176a59ecf6179de7c38f1c8d3d5a1901c514087c0fa6b06b865b3c72be1cfd9c34f82d0beb727db028e14dfa2d92b687bcacaa1e59be1a8ef4fceaf02681360e
- SSDEEP
  
  196608:oyUrYorj3f/9LoEyOULkTS7ys3r3wb3IhGfLjSvx5:of9xDxULkTobuwqWv7
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  Ms Optimizer.exe
- Size
  
  30.0MB
- MD5
  
  58b7ee8f89ce798c07c7585d41d4b293
- SHA1
  
  24adc394aa3de92844bba052c25866ce01bdca41
- SHA256
  
  ed386a79e63463746364bd5217a6ae32bd27961ba9701fa50a55ec6745c1558e
- SHA512
  
  cdc3673977266c904fbf7ae2aba6dfa9850cda82abbb6465db19d49406a8f2c5b1dca9c9c567f6666d83cef82e3a310f6af5af09f846cbb4e369bea1f2e784d5
- SSDEEP
  
  196608:HDD+kd1wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWY:j5QIHL7HmBYXrYoaUNP
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  
  4G�$��.pyc
- Size
  
  1KB
- MD5
  
  55c8f0dff5d657decedfc9470699bb0e
- SHA1
  
  be4d851650e51abccdc31feba60f50455f7864c7
- SHA256
  
  68f87ec58e965178561ea802a324e9d240e62226b4e7bca3ee2fd03c7dfe225f
- SHA512
  
  caa6de7b4d8d0d5424722d5a9ee6f6f06931bba1b466dfd4c1e87e673942eac3634684aae1b293ffd50dc756acf39472443cf86f9f34b7b41e44776e4e91ddfb
Score

1^/10
behavioral5 behavioral6