Extracted

• • Target
    Screenshot 2025-08-29 at 15-15-43 Stitch - Projects.png
  • Size 37KB
  • SHA256 c94e908cf7bc52a054f2996153ceb7a237e94a3dd6adaac68ce144d1140c0502
  • MD5 9c6cd8e6479a8703e913b340fa5344f3
  • SHA1 f4fe5ef3bea03348e0d1c03c4163af7f899f946c
  • SHA512 5310ed2103b49ab343c3a9f673c86dcf1a501e5a92031096d05f3f3432fa0d73586ea1a2aea6a87ff97da4b5ceb0977a3511340d1719a5d0a7670c4b38c0cd85
  • SSDEEP 768:lZjekxEKptDZ8QnMdTEyhnXdPFQfQo1FAWx6JvPec5Huai:nj/Ekl6dRBGfQo1Fzx6JlHut
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionblankgrabbergurcuxmrigminerpersistenceprivilege_escalationpyinstallerspywarestealerupx

  • A stealer written in Python and packaged with Pyinstaller

  • Blankgrabber family

    blankgrabber

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Xmrig family

    xmrig

  • blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1