db785ff3c8d1f5b8d1460e5e3afcc9b9905370a48659818c8262a5d1daf946bb

Sharing

Copy URL Twitter E-mail

General

Target
Lethal Grabber.rar
Size 78.9MB
Sample260723-gs4eeasblb
SHA256 db785ff3c8d1f5b8d1460e5e3afcc9b9905370a48659818c8262a5d1daf946bb
MD5 9f1cafb51a2d2a0e35191838d5e6ed7e
SHA1 b7609113e5c9ecab24e4301f0599ebeb18887275
SHA512 3356e1eb8a296b32b45faca3855c064dbed64243ba476f119ec9aa275d29680e13246576692f083e60b3595335a6f7596bb2b8afdb50956170d5e2beb89d3413
SSDEEP 1572864:c60S5uDTU0WD1YiTkJysDSGbXazh/6Mss1ZQHumWx8XBbGY:UU02RTeyQShYMb1Z7n8f
TLSH
T19A083373D090A761BA49863EF769EEC526701C4E0D1B5CC38A4452C64BEBE799C703BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal Grabber/LethalGrabber.exe
- Size 78.9MB
- SHA256 b1901b831bde16a46403db94010ae110283cfd8ca621950d94a85b555ec4fded
- MD5 529563c30a4dd7d9cdcae8fac78abc2f
- SHA1 ea14d46ece82877e1d9d2cc7c9f80d0ef9eb7bd8
- SHA512 b809f09964c7b49fd259e2343d5d613b8831fe186c62fbc6dcf740f208c8be1eb49ad0e48f0d7367690cc3a95878b7e249d59318bda0833a7df2d33a90ba4d3a
- SSDEEP 1572864:43doebfDspxT6EUwae515GU/aBIBdzpb2vVh20eNehWROThOcYZgtcG3:0ZyxT6Ej351DCKvl2dh9Ew4OThOZStcG
- TLSH
  T1110833EBD0B6F80DE11B65F12BE43D181E331A9A1AC54FB8D5C07969321BADAD13B305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence pyinstaller spyware stealer credential_access
- Adds policy Run key to start application
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Lethal Grabber/config.py
- Size 247KB
- SHA256 6505e6116b4f86a1022323a6d543e0a154c1dbd095c9f22afa17fdf56d1e1ca8
- MD5 6d189aae1b31a78b659831daa1155887
- SHA1 aa7cd87202122bd85dda5279859c8b3d81bca19a
- SHA512 4122dbe86e58559b29f920108d5793d4af9d1c9637b48b1172bbdf82936c0496f84f9365b746c084a7ac53350ff4735ce5f441ca59e7e780fdcba3f462c89dbd
- SSDEEP 6144:XahGMjHMGYJf2lOniSy5KOjAHTNPMrX8Z1qJ:XahOD2lxKYAHTubEU
- TLSH
  T19E341713CEA33E958FA48A8315DD6DD22E5D23CE30A30DCD458FCF95D688A2654E21DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Lethal Grabber/start.bat
- Size 2KB
- SHA256 4d700f333bc6e9f55e25ef70bff4891d87976812d11d4cf5a39c0e1bbeeae9b4
- MD5 657629187dea3899b40be49f26e80369
- SHA1 92e4af4f7fbbcb85c32819ab3c6a895954bb6e65
- SHA512 d97e0f8053da805c2d32c0f0c97b858ca9351f918845ebae15791980f1db60e89585a7b3b691a9ce9c085e7b538b95c3f5475f581a08271c409553cc85264740
- TLSH
  T1FA51EB493205F02D35B4C98B88794266F323D1F706825E9DB06B4075DF6774271FA7AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11 behavioral12 behavioral9