blankgrabber | ae25c8c7f3f07bee1ff7847fd8f249630191d448f4f47f1a5b5dda94ffef42ce

General

Target
xae25c8c7f3f07bee1ff7847fd8f249630191d448f4f47f1a5b5dda94ffef42ce.exe
Size 10.6MB
Sample260702-2jckjscw7m
SHA256 ae25c8c7f3f07bee1ff7847fd8f249630191d448f4f47f1a5b5dda94ffef42ce
MD5 c1b4462629ad06e87be3df377e1345fd
SHA1 8291c1269f72be820136a8f8a7acc99694c59038
SHA512 a4b7f37c446e2a53993f569612daf3b0053ddc52693d9185b678f39e0ca71eda1f31ffdd786768354c2e6d73c771d7ba9d6f1ac1a706282f2807d82a08aa3b97
SSDEEP 196608:cveU1183j9fZwQRCgLhiTj0In7jpIQ7IW7XFDZ+hPdx3+3HMSP:cvow8TKj0aITWLFApdx83
TLSH
T173B63359A7405AF6F1F3093AC8639A24EFB774554B60C2CB42E0DB691F372E11E76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  xae25c8c7f3f07bee1ff7847fd8f249630191d448f4f47f1a5b5dda94ffef42ce.exe
- Size 10.6MB
- SHA256 ae25c8c7f3f07bee1ff7847fd8f249630191d448f4f47f1a5b5dda94ffef42ce
- MD5 c1b4462629ad06e87be3df377e1345fd
- SHA1 8291c1269f72be820136a8f8a7acc99694c59038
- SHA512 a4b7f37c446e2a53993f569612daf3b0053ddc52693d9185b678f39e0ca71eda1f31ffdd786768354c2e6d73c771d7ba9d6f1ac1a706282f2807d82a08aa3b97
- SSDEEP 196608:cveU1183j9fZwQRCgLhiTj0In7jpIQ7IW7XFDZ+hPdx3+3HMSP:cvow8TKj0aITWLFApdx83
- TLSH
  T173B63359A7405AF6F1F3093AC8639A24EFB774554B60C2CB42E0DB691F372E11E76322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2