blankgrabber | 8d347ae2354b8e5e89fe1423c55b67d7d3b27f280b71187c89cc3a6b62ee74ff

General

Target

NexusFiveM.zip
Size

7.6MB
Sample

250210-pazx9ssjdx
MD5

c2054a9d1afb4539237720949c77da10
SHA1

0ad2fe6d71bb9c1f7f93974711957f60336a3b9d
SHA256

8d347ae2354b8e5e89fe1423c55b67d7d3b27f280b71187c89cc3a6b62ee74ff
SHA512

188c12313abb0cb5888e1dee155aac4813c284c232d63c04550342773fa62a76ec21ba0cddfbf363d0c14cd2eaa9a47316ddfff2f65fb0050bc69a1dac4c47f1
SSDEEP

196608:0LRgFWwfI9jUC2gYBYv3vbWY+iITm1U6fd1Ed:8yFdIH2gYBgDW/TOzbO

Score

10^/10

Malware Config

Targets

- Target
  
  NexusFiveM/NexusFiveM.exe
- Size
  
  7.6MB
- MD5
  
  4e4b715046fa491f2566949a8323fb78
- SHA1
  
  335060ed70f4ee3471cd2ddce245e57e623e109a
- SHA256
  
  8d847a8e298457cd0f8f249457ee75ca62f1a73a39a0748841eda05eb99f8fcf
- SHA512
  
  9970f79ddc60a7bcd14c0de9f56091fd0d7033f533774f728a1cf1ceef15e9cebb3a7777b9ad17c5ce3fd12ec9bcd80d7fbdc387f279743af87d6d0fa8077845
- SSDEEP
  
  196608:TLRgFWwfI9jUC2gYBYv3vbWY+iITm1U6fd1Ed:PyFdIH2gYBgDW/TOzb6
Score

8^/10

upx discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  ��g��<.pyc
- Size
  
  1KB
- MD5
  
  131c59a8843f1504260d2a6b673b072b
- SHA1
  
  0e78289758ebfede2afd0d0fd15797094d671263
- SHA256
  
  b76c58af97d3e6266194ea7dac87ad0a557dd9de245a645e8cc09d9979c99720
- SHA512
  
  b0e0a2df67f5a64c9063e6db6ab5186666e3930f57d3de1c9f62f290ba4ca795febf846079ef7c8521e89b47370a6ffc98c6a7e4dc609af362b50d2299ea7505
Score

1^/10
behavioral3 behavioral4
- Target
  
  NexusFiveM/settings.cock
- Size
  
  61B
- MD5
  
  377babab8f5672e6a9a956222a90ace9
- SHA1
  
  e7278e29ad63624bba56f5bdf94756fe2effa868
- SHA256
  
  9c03521cf83ad553057350cbe33fc6f11baebbed2e5c67281654d43f704199b7
- SHA512
  
  33dffdb2e6ef9ca2ca328bf81e46b447c3eccd2b6a97d297d173c0582a5889dd8b549abd3b9c914213f6c4887042493c91616e3ac13d1eee597bd31688cc1b2e
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral5 behavioral6