General
- Target xd5d6275da0c937cf2faf3d3dd19d59663734a3dab57789fa2ceded7ad2340e03.exe
- Size 30.0MB
- Sample260708-deq1daay4j
- SHA256 d5d6275da0c937cf2faf3d3dd19d59663734a3dab57789fa2ceded7ad2340e03
Score
10/10
Malware Config
Targets
-
- Target xd5d6275da0c937cf2faf3d3dd19d59663734a3dab57789fa2ceded7ad2340e03.exe
- Size 30.0MB
- SHA256 d5d6275da0c937cf2faf3d3dd19d59663734a3dab57789fa2ceded7ad2340e03
Score10/10A stealer written in Python and packaged with Pyinstaller
Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.