blankgrabber | bd73686c88743556972472738ab96da3d0f2b33e89e3d0ad2d3114c632b32a9c

General

Target

Builder.exe
Size

7.8MB
Sample

250201-1lgfvatlhn
MD5

b27a276fc395ac30ecb3dbc0968c7e22
SHA1

7987b2a6e6decd5e5e64e75fefd83b85a4b1b216
SHA256

bd73686c88743556972472738ab96da3d0f2b33e89e3d0ad2d3114c632b32a9c
SHA512

e85b4d2657da483d76f72ef1ae0a5306921a6bbdf4aab12fbf7478378a58b657c70785fa70f28ab2ed9c72bf1a44a8ca235ccff8b0d125878917f36de8e19290
SSDEEP

196608:G7D+kdWwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWe:05rIHL7HmBYXrYoaUNF

Score

10^/10

Malware Config

Targets

- Target
  
  Builder.exe
- Size
  
  7.8MB
- MD5
  
  b27a276fc395ac30ecb3dbc0968c7e22
- SHA1
  
  7987b2a6e6decd5e5e64e75fefd83b85a4b1b216
- SHA256
  
  bd73686c88743556972472738ab96da3d0f2b33e89e3d0ad2d3114c632b32a9c
- SHA512
  
  e85b4d2657da483d76f72ef1ae0a5306921a6bbdf4aab12fbf7478378a58b657c70785fa70f28ab2ed9c72bf1a44a8ca235ccff8b0d125878917f36de8e19290
- SSDEEP
  
  196608:G7D+kdWwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWe:05rIHL7HmBYXrYoaUNF
Score

8^/10

upx credential_access discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  ��T��?;.pyc
- Size
  
  1KB
- MD5
  
  7afd1a9cd0aaa0c3dfaacac358a84f99
- SHA1
  
  ec01037198f267dfbb9494650f20e16271f3e7b4
- SHA256
  
  9afb1ab0648aaa616a0de4537a594c65a82ccc7a8447dce592c89f616086e8f5
- SHA512
  
  4a2a9010ba114605f1d5412b1e837c06529543374ae32b284894aa0e1a8f2ab40a57d1d214b66af787f30160ef733ad92573100f65871c726da4a14c7c470df8
Score

1^/10
behavioral3 behavioral4