blankgrabber | a343df4fb82d42b61ab4fb7c0073e095dc4f06ed21361ab8bf207c54bd5734e7

General

Target
xa343df4fb82d42b61ab4fb7c0073e095dc4f06ed21361ab8bf207c54bd5734e7.exe
Size 27.9MB
Sample260629-c8phzabw3x
SHA256 a343df4fb82d42b61ab4fb7c0073e095dc4f06ed21361ab8bf207c54bd5734e7
MD5 d0017d007054a65e59a863ef58d88560
SHA1 54749a6f65bf1a58ff15df63a18703247e3a257e
SHA512 f3d39101a206a8b1fa5c6ebd7f18d2b44b2c83552efc2ca38c0cc17d9af38a350c74097b3e2f1217b842c46a8f7c923bf895be11f63029bce51e73955b098bb7
SSDEEP 393216:CHmO4baLXUzQmLFNN7qF4T3cgQDW1RbrK2pM9B3QZ+UdIt8sxVxWuF:uF4uLXOnN3cgQDqRbrKkeATdbsxVxHF
TLSH
T118572201B99180B3C5AA09305479BB7F58796E300B28E5CBB7D4399C9F723E16EB1397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  xa343df4fb82d42b61ab4fb7c0073e095dc4f06ed21361ab8bf207c54bd5734e7.exe
- Size 27.9MB
- SHA256 a343df4fb82d42b61ab4fb7c0073e095dc4f06ed21361ab8bf207c54bd5734e7
- MD5 d0017d007054a65e59a863ef58d88560
- SHA1 54749a6f65bf1a58ff15df63a18703247e3a257e
- SHA512 f3d39101a206a8b1fa5c6ebd7f18d2b44b2c83552efc2ca38c0cc17d9af38a350c74097b3e2f1217b842c46a8f7c923bf895be11f63029bce51e73955b098bb7
- SSDEEP 393216:CHmO4baLXUzQmLFNN7qF4T3cgQDW1RbrK2pM9B3QZ+UdIt8sxVxWuF:uF4uLXOnN3cgQDqRbrKkeATdbsxVxHF
- TLSH
  T118572201B99180B3C5AA09305479BB7F58796E300B28E5CBB7D4399C9F723E16EB1397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor costura discovery blankgrabber xred packer persistence stealer adware ransomware spyware
- A stealer written in Python and packaged with Pyinstaller
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2