blankgrabber | 9a841bd65a0ec2fbdd7d5311cc9c658822140b4a8c5f146e6e4e7121aea1c69b

Sharing

Copy URL Twitter E-mail

General

Target
SAK CLEANER.zip
Size 6.8MB
Sample260905-cpmv2a11dy
SHA256 9a841bd65a0ec2fbdd7d5311cc9c658822140b4a8c5f146e6e4e7121aea1c69b
MD5 2ec6fd00b7cc7bd0d132e6d25f2edde4
SHA1 eb8ff3d92e3491e04f24dc1fe30eacd5a54b3fba
SHA512 ff583eee921e2501bd01d672127f7cb30514b30401d0ccdfb91691279fff63420550e8a19cc800087bb4f01843aa92cdb76fb23aea5d0e691afbbf7c15b5ba84
SSDEEP 196608:6ccDuq6JBeYtmhDXG9smRoZ0IZTnW5VWfP:6gqwqhDWSmGZ0IZTnqs3
TLSH
T15D7633ADA6B19AE7D29B3DD1C1D47AE44420CDC50F985D109B8F1EFC96AED00849FCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SAK CLEANER/1- Cleaner.bat
- Size 1KB
- SHA256 7bdf3cfcd458fe5de706dceb5873343046e481233abe9f60ea63633d788027ad
- MD5 f3a60b82f758ea4e7ecb9ca473c1e99d
- SHA1 5393702183f27e9efbfd9434ba05b8449b36bfe8
- SHA512 f943e5674a2c7e611d60fd32a1a34886cbe3a61f44037cc504d27570c3d67ab2af74461441e1eb1bf67ac17c784e16d35dd3770f654efbc80e2278697ca3beff
- TLSH
  T17511F01420498A1733F39D74CB123158F69FF287791C89B1F062A4949EA93C5DDEEDE4
- MD5 SHA1 SHA512 TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2
- Target
  SAK CLEANER/2- Clean.bat
- Size 512B
- SHA256 fc4ea2d360de896e3ae5ad1d7831fcfefdd18a2e7754ccf0d6271a034a4284c2
- MD5 1c8a46e47f30c1a94a451b4187e3d36b
- SHA1 0af19fe40e7f29acd282098c0c026281f193fe04
- SHA512 1c8e55d7ed79c07faa8151372fd25104ef4504c706bcd0891aac6ed3298baddb9ca042baa8d7a6bfc4526b15296bbe3636f9b287166777b41ba6acbbc30f6d41
- TLSH
  T125F07A1A35A8B23089759958CBEFB77B0CC4B041CB925E15E7C20175B598F63E627EC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  SAK CLEANER/3- Del Logs.bat
- Size 892B
- SHA256 e1ef04bcff94fd02a606a6ab267027d4e799f9510b3f8cec32ed8dd32b5a6a88
- MD5 1a77a87536950f7b5bce7a7a81a00486
- SHA1 dd295dfa0ed012780204c4c3ca24c76ffb180bd8
- SHA512 abb0298fd2bd18aaf592751e81cda699078b45f304bb8efa15f845ced8fc12842e307b4e4ac3a041097b8b80970bfc4ffce17e7becb56ba377db665e028a91b0
- TLSH
  T1DC1190051D898A2233B6D5B0D7122144E66FF347781888B4F1A2A0909DA8284DEFEAE8
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral5 behavioral6
- Target
  SAK CLEANER/4- Del temps.bat
- Size 1KB
- SHA256 e2d994abafba75f9fb698427ba9be5306261b81793c9ba94fb869cfe99602f68
- MD5 e9914643b2f2f92a459ea2b612a9b89b
- SHA1 461abd96494679cedb01e99558b93be75b3df4d8
- SHA512 08208161a70a98c5ff82f1971f494990d3105fdce5efc6a3620fbe6d5481d6db42ec8632441dae84aa6f0677c0d8392486c523c6717b1d4d41c0b31617000817
- TLSH
  T1DF11BB041E9A862623B5C670D7162207E65AF34F7D1886B0F19161909FA82819FFE6D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  SAK CLEANER/5- Last Activity.bat
- Size 31KB
- SHA256 7aa3e715b1d976cd58dd787d65f224f24cbfbb9e284a8a4d2363f0e26c5c2740
- MD5 decdb1972602295a30852730b21ec5a1
- SHA1 d22301ab7fcd9208da8a411e6f35642d8a921447
- SHA512 d03b3fca15b66f4dc39eb3e2fa852963fa11971f5a196c3974e2b411dd8793a9b555613a00ff98d826713c9a0f8cea8271c18186a4a35c4262704d625c73847a
- SSDEEP 192:TmNNTTpRTpAHR55fjX5FL0VYIFpmmMF6i5lMFmRlMUMFTiyiYYwQ0H1fDZn:4NTTpRTpAHR3fjX5F0VYIzUwiwoClrZn
- TLSH
  T10CE2ED8032D48A01E1B2BB21355A9C718FFBB3DF74D99E0B98D5790821AFA4DD0653F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral10 behavioral9
- Target
  SAK CLEANER/Protection History.exe
- Size 6.9MB
- SHA256 09a0e5c2c745ecd52ec4bf8299276aaa46f1c18b2bf24d604d468fb281c8b55b
- MD5 430e457b35e7c66137c73b0eda76fd0a
- SHA1 03efe888a47939b680cc50074bac67a13d32ba33
- SHA512 b29941ca5a05d93f94d422cc8fd3782d7d0f0f3c5af3d7e8f574620db2b8d050898645090a5fdc9af392e710fb66c2f890c77cba1529b895f3dd6e38c1cade6d
- SSDEEP 196608:cW0ZYJYs5VeNTfm/pf+xk4dWRumrbW3jmzr:tJYcuy/pWu4kRumrbmyf
- TLSH
  T12876336973F008F2E9B329BDC5819959C631BC550B64CE8B43684AB91F27A904D3FF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12