blankgrabber | 1fbeead19a3ab8700cf86cec5dd34df5a14a758baaf38123f87561fb7eb30e1f

General

Target

CRAFTRİSE.rar
Size

11.3MB
Sample

250207-ttg9sazlek
MD5

9af0ed3812aed4ccb0809832fd6c0ed1
SHA1

ce539f1ec3e58e591d964164855b93202d33a9e7
SHA256

1fbeead19a3ab8700cf86cec5dd34df5a14a758baaf38123f87561fb7eb30e1f
SHA512

42db08b71d2e44c0c2fb3fad736028e21fce05d00264f49f5c478330086aece941354f89687f5156af11dbc2ae4281c0cfffb04fdf5d34adb21005526ba8d20f
SSDEEP

196608:4RFomdWwfChtl6MwZceS5Nra1uh0N16XOJ8+/07ttP1Pq0zqHKrsx77Z1P2fxlqt:rwfCXxQMmMuN16eJYBNI05rU76fJXc

Score

10^/10

Malware Config

Targets

- Target
  
  CRAFTRİSE.rar
- Size
  
  11.3MB
- MD5
  
  9af0ed3812aed4ccb0809832fd6c0ed1
- SHA1
  
  ce539f1ec3e58e591d964164855b93202d33a9e7
- SHA256
  
  1fbeead19a3ab8700cf86cec5dd34df5a14a758baaf38123f87561fb7eb30e1f
- SHA512
  
  42db08b71d2e44c0c2fb3fad736028e21fce05d00264f49f5c478330086aece941354f89687f5156af11dbc2ae4281c0cfffb04fdf5d34adb21005526ba8d20f
- SSDEEP
  
  196608:4RFomdWwfChtl6MwZceS5Nra1uh0N16XOJ8+/07ttP1Pq0zqHKrsx77Z1P2fxlqt:rwfCXxQMmMuN16eJYBNI05rU76fJXc
Score

1^/10
behavioral1
- Target
  
  Extreme Injector v3.exe
- Size
  
  8.1MB
- MD5
  
  457485a147ba16fd5b48122aadeae951
- SHA1
  
  8948736fbdb8ddabee27461173c8ec285b570b79
- SHA256
  
  749ed97838f41d2c8d955b5f61cc5cd38b94b42e3fdeea1b76ed262164ac6d86
- SHA512
  
  d743c830207f7263569d422c7431a77f02c83299b2b3695df75e6389f2742a4df4f9e0f6625b2ff1319d8213aef260a2c4b2f96f172be2c314ec4a1a916f3e40
- SSDEEP
  
  196608:H0V1vV44/5DB6ylnlPzf+JiJCsmFMvQn6hqgdhw:id5DBRlnlPSa7mmvQpgdhw
Score

10^/10

defense_evasion discovery execution spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  r�tD��.pyc
- Size
  
  1KB
- MD5
  
  5ff71b622f51bf52e233299e570e467f
- SHA1
  
  d2811be49ff68bd74e2a6432f9e61ee0b34fc2f4
- SHA256
  
  92101f22b2118f23d6cc067c405edcc85f33625c92ab8409f91c7f581f99b390
- SHA512
  
  06350820b26a511210ab2341fc1eb7d9abbf554de8ad2dcf1a1d4985ee3b9ea2a8355de760f0b6000a6dcf7247399e1cb4cac79670b6198d1d5afcf5f2172e9c
Score

1^/10
behavioral3