blankgrabber | ba87a9e48f403b2c0e70ce957e0db882a163e6d8322afeb219c158dfc17baae6

General

Target
Downloads.zip
Size 15.8MB
Sample260807-m8tg2atdlc
SHA256 ba87a9e48f403b2c0e70ce957e0db882a163e6d8322afeb219c158dfc17baae6
MD5 27e18d12f6d5a1baa9be1f3efc3689c3
SHA1 8ed7d36749fbba861c247d7aa1a8a130b27a7009
SHA512 e88545d6a6828c4b99c864132d04ccea1b2f096b67812f01dc64178f169b27ce88e305c48dd3679471301672c8649b07d3437484343b6846196b6ee98ac4550c
SSDEEP 393216:uli9veoP8QD0K3pUXy2hNiVbo3XsAYHzU3pZZMYBA1tcfif:OiUo8mXuRhN4csAYHzU3ZMf1tkif
TLSH
T163F63395762D8342C4F93C640611EAE4A2AE8D48D708DBFCF21C4536DA7B4A44BB51FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NOVGK.dll
- Size 399KB
- SHA256 ae18408b5eccf62d3360907166d07eacdf4161ec4320c2e4f38fc911c670a5df
- MD5 06e089eb17362011778ad37e3ef429a0
- SHA1 138b43197b5336e555779ff616fcce12eeffb55e
- SHA512 0ff5988f09193f368193515e6ca3547c95e17367dc4306c90910e0e0414a9d14139321e9f4457e88e3506719580afe235fec4ae1c67415fcac5fca929fe668ac
- SSDEEP 12288:mzbWncVOFC7A+Ozg1lZXekZXNkMClAA5Mt4Cv2o:mvWndF8VXN5A5Mt4y2o
- TLSH
  T131945C1DEAD1026CF177F9B45DB39502FA71748D076999DB07E048A81F2ABD0E63BE02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution darksiderat trojan discovery
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  injector.exe
- Size 188KB
- SHA256 864a9f668e5570be2bf94113fc3dcc3f31b6f4078102622c14048578fd614e4e
- MD5 0a6b01c0895c126e58e2e31ffbed306c
- SHA1 8bbe4f11f4a6fdedfa7b6a80b2ff4ade5685f8ac
- SHA512 d7a4822373c88057a42ff020b2db4757ec20dbb26710d384f37c1f791be23f42654a54f19748475c2ae712a446b016ab967fc1b68f2ba775f24f8f068f0053ff
- SSDEEP 1536:DgabVDoP5c2fTpHLzq80wWgl+lxRIPf+60N3hmg7AG8Du6+WSss/eYwp:DgabV0+kT5q80UlbdI3fUY6+WSvm
- TLSH
  T139147D26DF16547ED2ADD578C9530C46DA32BC8A4391AACF17808DE30EB6BD09F3D602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darksiderat trojan defense_evasion
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  needvgcrestert.exe
- Size 16.5MB
- SHA256 86b23ba96654bfd2e0228e70131ba440de40abbf2d70f474bf9aa807b610c71a
- MD5 8f73963bcc496c59ede9e44745ec435e
- SHA1 f9e1e210a34d05c166bed1dfccd74c8133dca18c
- SHA512 756d0454982e1c6ab9ecd7678060813a68a33e06b4be4b5eb894f0ca07c1060c13de84b3f706ec440df3d8410a477c3880b26efaef5007a9ea3de9cc2bd10783
- SSDEEP 393216:M5Iy9BVEE0t7RLaV9K2pM9B3QZSPl3s89VqkHVkptz7qWPazdMlSt:dkKkeA4l3s86kHVkpFqDzd22
- TLSH
  T1A107239E635422ECC46BC0788523DE06F3B2741E07A1D7EF72D697912F13AE09A36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution darksiderat persistence privilege_escalation spyware stealer trojan upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6