General
- Target fcam_pro.exe
- Size 18.8MB
- Sample260730-q3engaygpb
- SHA256 28c45879b866e198ec95276209dfdfceb22542822327fd7e7a623c45db87eb53
Score
10/10
Malware Config
Targets
-
- Target fcam_pro.exe
- Size 18.8MB
- SHA256 28c45879b866e198ec95276209dfdfceb22542822327fd7e7a623c45db87eb53
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger