General
- Target fcam_pro_2.1.rar
- Size 18.8MB
- Sample260730-sn2wkacj7z
- SHA256 08d991556d9f39b1a06a4bde360d88ce6befad19e6b586d07f044708ab46c351
Score
10/10
Malware Config
Targets
-
- Target fcam_pro.exe
- Size 18.8MB
- SHA256 28c45879b866e198ec95276209dfdfceb22542822327fd7e7a623c45db87eb53
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger