df6bb8218b94eecf4f609586624caca802eada8cb0d344706bdf1ec81ef5e59f

General

Target
Lethal Grabber.rar
Size 84.8MB
Sample260704-ps7qtsft3x
SHA256 df6bb8218b94eecf4f609586624caca802eada8cb0d344706bdf1ec81ef5e59f
MD5 8c742e02fd15fd8ac2cc9f04990bb73b
SHA1 22e81205160f3ebd067f4e39a6e3c50447d0456c
SHA512 0f22da67f717882a8e8309ff659bfff62be632c729cf918f1bb49b94d5206cf0d6fbba305758bf51c06ef8d1672b0eb0890bfc47eba134f66d6d097cb6186828
SSDEEP 1572864:UNB3CrbNaOLvTkc5z/YWq1Xk09dGWILrw+f8HoJJluHU6ezUMQvITnJ6H2QBdN:UNBSvNaIkcFYt1Xk0GWEfaoJJluVeCIi
TLSH
T186183354A276ABB4468234113EC0D6BE53FBD01F1A4F6A81DB4E0D372BD3D1A98BF158
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal Grabber/LethalGrabber.exe
- Size 85.2MB
- SHA256 b5c82494b6f293badeaeabc09740c69c3d12786c8eccffb3eaf3eb8cbdfa0907
- MD5 0d6c4704f9ff39de9f760b99fcc2f31a
- SHA1 34daa83143eab57a44b37bd59cf9d4ff7c62b2eb
- SHA512 b03af3bae3868ced5f53a8b020ed9951fc2e4a1292deeb77cae09409ae29e9358ddb483b4c2763a0d5a5b20705f3036bda2b0304883afc01a0ded8e5ad1a4a9c
- SSDEEP 1572864:32Y13gOcz2Ku3yyfnRR6rpZqa4jdfeFwvLoYyFooZyLxw9qZw+:32YajKKVuKpZqa41eFwEjOTTb
- TLSH
  T1FA1833152F1C4EBDA55201DF00EAD7EBEDBFB28191E053E10B5E265A417BB64B1BB803
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence pyinstaller spyware stealer
- Adds policy Run key to start application
  persistence
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1
- Target
  Lethal Grabber/config.py
- Size 1003B
- SHA256 69407aa18721a386f69ae989ea556d868f5c3dbeb9663dd60c76bc74b9997dad
- MD5 24591ff669cc7af2cdc4b4367525fa6e
- SHA1 fccf4a4d11204a637d6d15791706f61bc699e1b5
- SHA512 102ca7849ed293815fadf7a93149ec4fb0e0e7622979a9a1e54c6a901c1e35ee1b9e0d1267a2654db38fbf2c39adaee111e515efcac0008235e359d8daf238c2
- TLSH
  T12011E183CD6E202685F28619842085B6E7876317F5338CB2BDEC9A545FBC470C12557F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Lethal Grabber/requirements.txt
- Size 22B
- SHA256 81345b77a704c2a195b4c07f608e2564b802b9551ff8646fa4dccafe0d7b4e9d
- MD5 b0084972dd2f17b67dac5ee05611d7db
- SHA1 9991fcf6fa6189314dc73915891535d91cb1d58f
- SHA512 358f99302717863f4d83bd41a039091a0df05f52e53cef9112b820f479f3b566bf63a779275d01a92cbc6d0b0a60f5786cf9eb9f950c9076633d39ac413c3138
- MD5 SHA1 SHA512
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  Lethal Grabber/start.bat
- Size 2KB
- SHA256 4d700f333bc6e9f55e25ef70bff4891d87976812d11d4cf5a39c0e1bbeeae9b4
- MD5 657629187dea3899b40be49f26e80369
- SHA1 92e4af4f7fbbcb85c32819ab3c6a895954bb6e65
- SHA512 d97e0f8053da805c2d32c0f0c97b858ca9351f918845ebae15791980f1db60e89585a7b3b691a9ce9c085e7b538b95c3f5475f581a08271c409553cc85264740
- TLSH
  T1FA51EB493205F02D35B4C98B88794266F323D1F706825E9DB06B4075DF6774271FA7AA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral4