513728e9607a21d09385ae978f32b69b6df41c9c91f77cea0c32652fbd2589d4

Sharing

Copy URL Twitter E-mail

General

Target
Lethal Grabber.rar
Size 84.8MB
Sample260709-tssdcses4t
SHA256 513728e9607a21d09385ae978f32b69b6df41c9c91f77cea0c32652fbd2589d4
MD5 bf45ce7771b3407b2958e6feb48d79ad
SHA1 1cb3721d9df9216a2bd174ca41d7b278c0a0fda9
SHA512 74f68ef7967f8176c06eafcd054da41d7c9e4590d576050936c9e3e3ab0ff4f595b9198fd21c9a8faf3b72374671ff30d8579b892068f2ceb22434d354bd727c
SSDEEP 1572864:/Pz+KgvccuXnVfKskIeXx2DT0gaR4CiQwqQ4Zl/XCoEfSpyu2z8/:3yU7XVfK9hO4g5CVwqQyCow7uG8/
TLSH
T10D183314B1CBECB2F416533582C9E7FB5BC54E0DDB9A08ABA76F3C610A9F006845DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal Grabber.rar
- Size 84.8MB
- SHA256 513728e9607a21d09385ae978f32b69b6df41c9c91f77cea0c32652fbd2589d4
- MD5 bf45ce7771b3407b2958e6feb48d79ad
- SHA1 1cb3721d9df9216a2bd174ca41d7b278c0a0fda9
- SHA512 74f68ef7967f8176c06eafcd054da41d7c9e4590d576050936c9e3e3ab0ff4f595b9198fd21c9a8faf3b72374671ff30d8579b892068f2ceb22434d354bd727c
- SSDEEP 1572864:/Pz+KgvccuXnVfKskIeXx2DT0gaR4CiQwqQ4Zl/XCoEfSpyu2z8/:3yU7XVfK9hO4g5CVwqQyCow7uG8/
- TLSH
  T10D183314B1CBECB2F416533582C9E7FB5BC54E0DDB9A08ABA76F3C610A9F006845DB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Lethal Grabber/LethalGrabber.exe
- Size 85.2MB
- SHA256 83f6b090aba405321b99689223d9e24ddecd275ccc57bac3cbb3b3372be70e2b
- MD5 258587dae3a0f5602ed36ecbd8c49c89
- SHA1 87e4e88a27f105a90e3f158085f78014450f4815
- SHA512 106b4c683003dbc84d2aa6dd53d19af4a5e52dc3d5dee174d4c597233cc366fdd5a87d51c5e156521d1908c4fde3911ea0db93aee66fedd065fc84c10a143f20
- SSDEEP 1572864:0+Y3FUgX6TQATEMKvYVxfpwPy1m4KE8BahFEowg+kr73PqPzHPvPym:0+Y+LTETvYVxfpw61m/PBEwZk3fqPbq
- TLSH
  T18F1833CE0B08F95456938290A5EA7A3D40A0684F2FF7412F4F279606DAF995BEF43D34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery persistence pyinstaller spyware stealer
- Adds policy Run key to start application
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Lethal Grabber/config.py
- Size 993B
- SHA256 eff40ccd76441919850347cdd1bd5a165cacb6db7481b83590e3b3ee6b4a2491
- MD5 c25eae03cb9bd87e3368d43fbdd3863c
- SHA1 e3ee6545f2bdc0ea833877120c032d171c7a90f5
- SHA512 7de4a5bd54cfc4f9834b202a16092064e884bb31e9f53d0c41ea5ad559ed41900c90642636640f7a193207fee05d1f41e61dab6623743091466667117306c774
- TLSH
  T1C811CE83CE6E212584F28529813085B5E7976313F53388A2BDEC9954AFB8571C12157F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Lethal Grabber/requirements.txt
- Size 22B
- SHA256 81345b77a704c2a195b4c07f608e2564b802b9551ff8646fa4dccafe0d7b4e9d
- MD5 b0084972dd2f17b67dac5ee05611d7db
- SHA1 9991fcf6fa6189314dc73915891535d91cb1d58f
- SHA512 358f99302717863f4d83bd41a039091a0df05f52e53cef9112b820f479f3b566bf63a779275d01a92cbc6d0b0a60f5786cf9eb9f950c9076633d39ac413c3138
- MD5 SHA1 SHA512
Score

3^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Lethal Grabber/start.bat
- Size 2KB
- SHA256 4d700f333bc6e9f55e25ef70bff4891d87976812d11d4cf5a39c0e1bbeeae9b4
- MD5 657629187dea3899b40be49f26e80369
- SHA1 92e4af4f7fbbcb85c32819ab3c6a895954bb6e65
- SHA512 d97e0f8053da805c2d32c0f0c97b858ca9351f918845ebae15791980f1db60e89585a7b3b691a9ce9c085e7b538b95c3f5475f581a08271c409553cc85264740
- TLSH
  T1FA51EB493205F02D35B4C98B88794266F323D1F706825E9DB06B4075DF6774271FA7AA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20