General
- Target LethalGrabber.rar
- Size 38.2MB
- Sample260620-r7fa8sgz2w
- SHA256 6feace38d8cd0567d537dfbbc83ba236fc653d3ea26d75b9166993d06db393e4
Malware Config
Targets
-
- Target Lethal Grabber/LethalGrabber.exe
- Size 38.5MB
- SHA256 2c01a70d1cf93d3e14d0262eb40b46083c57392552c2b11f386bfa530244d356
Score8/10-
Adds policy Run key to start application
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers new Windows logon scripts automatically executed at logon.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target Lethal Grabber/old/older_ui.py
- Size 171KB
- SHA256 8519c2f1705299d03ec8a420aca8a14e26b3dbd8b3239eea81f6f57bf9d6df80
Score1/10 -
- Target Lethal Grabber/old/purple ui.py
- Size 106KB
- SHA256 c190d187f50ab23b3af54ffe866a80b07c7f0eb61c7edff7a2babfb03f9655fe
Score1/10 -
- Target Lethal Grabber/start.bat
- Size 1KB
- SHA256 821a5dcaaa96b8d631e9ab61338cf109915ae3f3a09694e5146195c419de5d79
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Defense Evasion
Modify Registry
4Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3