blankgrabber | 348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861

General

Target

Loader.rar
Size

7.5MB
Sample

250326-t9brya1ls3
MD5

7d67a76a8354226bdef759e77559ef4b
SHA1

ce16e1d54a98f40f627d59fcad6731d4d1c7848e
SHA256

348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861
SHA512

f6ab8dc861ac5a9c5f6970e747e13b3feba4bf78ea5aed9e0d9e0aba671a1ecc2fcf10ea878ce224794888231d9c4d9d32bc799975be7d4520e009300935e4a4
SSDEEP

196608:zg5D7Sn0mxSg0AWelXnsQs8uks0CCw8dipUHFIS87:zg5D203ghXnq1X0/daGIS87

Score

10^/10

Malware Config

Targets

- Target
  
  Loader.rar
- Size
  
  7.5MB
- MD5
  
  7d67a76a8354226bdef759e77559ef4b
- SHA1
  
  ce16e1d54a98f40f627d59fcad6731d4d1c7848e
- SHA256
  
  348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861
- SHA512
  
  f6ab8dc861ac5a9c5f6970e747e13b3feba4bf78ea5aed9e0d9e0aba671a1ecc2fcf10ea878ce224794888231d9c4d9d32bc799975be7d4520e009300935e4a4
- SSDEEP
  
  196608:zg5D7Sn0mxSg0AWelXnsQs8uks0CCw8dipUHFIS87:zg5D203ghXnq1X0/daGIS87
Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  Loader/Loader.exe
- Size
  
  7.5MB
- MD5
  
  251ac55d55b47ec078473eeaa1e510e7
- SHA1
  
  1126ce753d5f4916e5e4f0fa5fa002bd7bce181b
- SHA256
  
  60bbd89cca19b257dd70d37ce4907d86e96b2711da5d945dd4204a88edad318b
- SHA512
  
  90120ff2ac2ad04758279695b43b45759829535d7b8519a2907bc2b1169a1e510a7e383e2347e7f15225de1a924bd9b77637d9c77e7838d99b062c279ae3912f
- SSDEEP
  
  196608:pWOgoiwfI9jUCH0+n4/JKIYJmg+Irj+dD1SAxw:28IHU+GJPYf9ydD1s
Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  @��>�.pyc
- Size
  
  1KB
- MD5
  
  a07c939df685b1df7d7586c76c1a64e5
- SHA1
  
  2c13a189be4633573cfe2e4caddd12735b8135b1
- SHA256
  
  e580dfdc4988dd2656b4a81849d460a00360f406c3f4d3677df673365301717a
- SHA512
  
  8c91f9524ada35f22b6b2c860cb10fb3deb81cea58e9c6dc1f7bd2f9134599b91167637513b788b1b7760a438d1825681d5474911624b0165cd9ff4a0f854517
Score

1^/10
behavioral3
- Target
  
  Loader/vcomp140.dll
- Size
  
  176KB
- MD5
  
  884c6f8718fd95c25e16a4789ae3bf7a
- SHA1
  
  33f7e6846498871927d21bed11cc4ef41804112a
- SHA256
  
  f8d8aca399a0f7e40b2993584404b31f13bf18ea657a5feb85b37b15a249a275
- SHA512
  
  48384af2f6359ca3ee6996fc34df8c357164097f0c0c5cb30f5bd080baa6af3b4bcada17fb94933a99955f97c4ac0e554ca2373a5638e29db84e8318165c7b0c
- SSDEEP
  
  3072:+Pr3XpMvAiR3LQpxELm3uFX1TfgZhPlUDJR9ZURc/5:+znSvAiO+m3uFFOj+O6/5
Score

1^/10
behavioral4
- Target
  
  Loader/vcruntime.dll
- Size
  
  94KB
- MD5
  
  11d9ac94e8cb17bd23dea89f8e757f18
- SHA1
  
  d4fb80a512486821ad320c4fd67abcae63005158
- SHA256
  
  e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
- SHA512
  
  aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
- SSDEEP
  
  1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
Score

1^/10
behavioral5