f73defcacbf73f3f6c1820952b9264d6cf7919c52dc3379beb2f93c30d814ff4

Sharing

Copy URL Twitter E-mail

General

Target
Lethal Grabber.rar
Size 93.3MB
Sample260629-mexmlaax8s
SHA256 f73defcacbf73f3f6c1820952b9264d6cf7919c52dc3379beb2f93c30d814ff4
MD5 d59a4dc25ab5c595eb3b9a6614cdb4bf
SHA1 5ff4b4ffaf0a71d943858497f4b975c97c9d633c
SHA512 e2f7f0a267a544a4a6cb44a03c5c63299b373d7c5dd8570bd86dd4fc887cd431b7ebc5962eff2d0ffc5caf1e94bc922e37815a4fc1fd6f0d8c90c03e35b667eb
SSDEEP 1572864:qc5sPdihtzg2ASI27zhlBQKHjBlssunATDmE7Ks+aqkJ4d33ndqRndL1+cczcWTm:VrL//D+EjTssunA/Z7MaK3dqRndJBcQR
TLSH
T12F2833A6E646FA9B07D38F1F79ACCD96FF71F3C904E3C454D2E30A5A18C18918145ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal Grabber.rar
- Size 93.3MB
- SHA256 f73defcacbf73f3f6c1820952b9264d6cf7919c52dc3379beb2f93c30d814ff4
- MD5 d59a4dc25ab5c595eb3b9a6614cdb4bf
- SHA1 5ff4b4ffaf0a71d943858497f4b975c97c9d633c
- SHA512 e2f7f0a267a544a4a6cb44a03c5c63299b373d7c5dd8570bd86dd4fc887cd431b7ebc5962eff2d0ffc5caf1e94bc922e37815a4fc1fd6f0d8c90c03e35b667eb
- SSDEEP 1572864:qc5sPdihtzg2ASI27zhlBQKHjBlssunATDmE7Ks+aqkJ4d33ndqRndL1+cczcWTm:VrL//D+EjTssunA/Z7MaK3dqRndJBcQR
- TLSH
  T12F2833A6E646FA9B07D38F1F79ACCD96FF71F3C904E3C454D2E30A5A18C18918145ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Lethal Grabber/LethalGrabber.exe
- Size 94.2MB
- SHA256 9058cbaa76b60e4d748a477daef036de1df262734f4e61e3bd746e606466319c
- MD5 dfe70c695d78c0d0806be04328e13144
- SHA1 5d2eecdb4633b867b41b07733f9f4b492c8747fe
- SHA512 5ba840577b58568ceee2a81115b34c0962c4a193c6533db6990123d8268fb3704e77b74774153b3e6cfc570ab91a05302c8368bd5404c1ef4a57e2584f8b1e28
- SSDEEP 1572864:Sm0XpntfapE63DAak5Q7YMUD+Y9bT6AvFm9w0a1F11p4Mg0VDE:GX7fap7C5Q7wqObTLy+F11p4M9E
- TLSH
  T1452833FEBD198A7E8ED510FF0238A32664F4FD2E14730190859E6DAF18B17E025591AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral3 behavioral4
- Target
  Lethal Grabber/requirements.txt
- Size 22B
- SHA256 81345b77a704c2a195b4c07f608e2564b802b9551ff8646fa4dccafe0d7b4e9d
- MD5 b0084972dd2f17b67dac5ee05611d7db
- SHA1 9991fcf6fa6189314dc73915891535d91cb1d58f
- SHA512 358f99302717863f4d83bd41a039091a0df05f52e53cef9112b820f479f3b566bf63a779275d01a92cbc6d0b0a60f5786cf9eb9f950c9076633d39ac413c3138
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  Lethal Grabber/start.bat
- Size 2KB
- SHA256 03cd420dc3527966375e7628bc4ff397c12d7db785a62e7f9dfe4ade82a1c6fb
- MD5 a51ca2d150ad7e02e42693367ff097e8
- SHA1 5378cf6dac727b32edadb9801361b9d45365cb1b
- SHA512 9decd38bec37b2067716d92241e70abf2a0adea37aca4372abd04927bf2767dde2b36d44eb2a109ca3637f287b49dc1df09153edc7480ed392d001237ae5fc20
- TLSH
  T17941A84D3A05F03DBAB4D89B89384161F323D0E31642AE5DB0AB0074DA57B8671FE32A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8