blankgrabber | 1fbeead19a3ab8700cf86cec5dd34df5a14a758baaf38123f87561fb7eb30e1f

General

Target

CRAFTRSE.rar
Size

11.3MB
Sample

250207-ttavpszldm
MD5

9af0ed3812aed4ccb0809832fd6c0ed1
SHA1

ce539f1ec3e58e591d964164855b93202d33a9e7
SHA256

1fbeead19a3ab8700cf86cec5dd34df5a14a758baaf38123f87561fb7eb30e1f
SHA512

42db08b71d2e44c0c2fb3fad736028e21fce05d00264f49f5c478330086aece941354f89687f5156af11dbc2ae4281c0cfffb04fdf5d34adb21005526ba8d20f
SSDEEP

196608:4RFomdWwfChtl6MwZceS5Nra1uh0N16XOJ8+/07ttP1Pq0zqHKrsx77Z1P2fxlqt:rwfCXxQMmMuN16eJYBNI05rU76fJXc

Score

10^/10

Malware Config

Targets

- Target
  
  Extreme Injector v3.exe
- Size
  
  8.1MB
- MD5
  
  457485a147ba16fd5b48122aadeae951
- SHA1
  
  8948736fbdb8ddabee27461173c8ec285b570b79
- SHA256
  
  749ed97838f41d2c8d955b5f61cc5cd38b94b42e3fdeea1b76ed262164ac6d86
- SHA512
  
  d743c830207f7263569d422c7431a77f02c83299b2b3695df75e6389f2742a4df4f9e0f6625b2ff1319d8213aef260a2c4b2f96f172be2c314ec4a1a916f3e40
- SSDEEP
  
  196608:H0V1vV44/5DB6ylnlPzf+JiJCsmFMvQn6hqgdhw:id5DBRlnlPSa7mmvQpgdhw
Score

8^/10

upx defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  dosya.dll
- Size
  
  3.3MB
- MD5
  
  d19041062a286834022770c877eeb53e
- SHA1
  
  3aaf989120248c927e7d30ca2949b68e780f73b6
- SHA256
  
  882eefc91685006718ef9851bd506facfd28004b55e3004e1052bbf024a32ac3
- SHA512
  
  292dab57bcaae0fedb797eb0fa08c8f35104f44188a72f251ea729cc8185450523e66514d49d5cc95285930077dd7869c8cb6c2f192d1bfb7ce771001283e63c
- SSDEEP
  
  98304:+afflX2x3VxXBwLPsbGArkjq9/BHH6uXY:+g2FTXihAwG1B6t
Score

7^/10

themida discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral3 behavioral4