blankgrabber | a9f258e279aa295535c24c5ef6cd669f881422427d6b0039eeb3318cf49123c6

General

Target
NeptuneRAT Updated V2.0.zip
Size 41.8MB
Sample260718-bctmdabs4j
SHA256 a9f258e279aa295535c24c5ef6cd669f881422427d6b0039eeb3318cf49123c6
MD5 c118edd7c49ad9bdfaeb1d0bfe3c7814
SHA1 7b5e84958f56a926b344f30e5a338e9e877b5e6e
SHA512 d8e3dde68d083990e26ffe2b30f4e605a178fe510412b85ac0592ab6c519a63a734ef6ce1b17f060e6eab0b5050db9d99fb984dd00a9d29e36bcd22f239e8ca9
SSDEEP 786432:MffkEkdG54R7s/FjDKJIEHvBe3bS4VXojzif1WHgFt7JIWYoC/kUiY3ME2e:QklOCCYSEHvBTOXojzif1CWPYJV/T
TLSH
T14CA7332CB89435AC9908FC374EC71DBC549CE1EA0E9E1EF7AA7B3713D5058E02494A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NeptuneRAT V2.0.exe
- Size 42.0MB
- SHA256 fd1013cb723a40d663f228324e6d95267df3588b697f2f670cd435f2bf05723e
- MD5 7ebde1fc5fbf80aaa06e23c258ec9563
- SHA1 af69dbebf3bbf5ba203ef4953c0bbc98f12ea5b0
- SHA512 2f18e8efa9f3657ae52ae3e548d1af725c57da637a1a258772037bd77dcc50b250b046736bda7fa3b89709c28b599dca56117d866d7c0b99d64963d665c1a31c
- SSDEEP 786432:aXeOAR0hqFpM75ZXM92eF9pmrjWUJlWdpCBliHGjnPzgMeAyFgEU6HiCW/:AeTKYOgseF9pvilWdpCBl8iHetx9q
- TLSH
  T1FCA7331CF6D400F8D405F8388ED30959E6BDF89A0B659EAB17A937139F076E01D78B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber milleniumrat stormkitty persistence privilege_escalation pyinstaller rat spyware stealer upx adware ransomware
- A stealer written in Python and packaged with Pyinstaller
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- StormKitty payload
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2