SAK CLEANER.zip
- SHA256 9a841bd65a0ec2fbdd7d5311cc9c658822140b4a8c5f146e6e4e7121aea1c69b
Overview
overview
10Static
static
10SAK CLEANE...er.bat
windows10-2004-x64
9SAK CLEANE...er.bat
windows11-ltsc_2024-x64
9SAK CLEANE...an.bat
windows10-2004-x64
3SAK CLEANE...an.bat
windows11-ltsc_2024-x64
3SAK CLEANE...gs.bat
windows10-2004-x64
7SAK CLEANE...gs.bat
windows11-ltsc_2024-x64
7SAK CLEANE...ps.bat
windows10-2004-x64
3SAK CLEANE...ps.bat
windows11-ltsc_2024-x64
3SAK CLEANE...ty.bat
windows10-2004-x64
8SAK CLEANE...ty.bat
windows11-ltsc_2024-x64
9SAK CLEANE...ry.exe
windows10-2004-x64
8SAK CLEANE...ry.exe
windows11-ltsc_2024-x64
10Behavioral task
behavioral1
Sample
SAK CLEANER/1- Cleaner.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
SAK CLEANER/1- Cleaner.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
SAK CLEANER/2- Clean.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
SAK CLEANER/2- Clean.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
SAK CLEANER/3- Del Logs.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
SAK CLEANER/3- Del Logs.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
SAK CLEANER/4- Del temps.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
SAK CLEANER/4- Del temps.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
SAK CLEANER/5- Last Activity.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral10
Sample
SAK CLEANER/5- Last Activity.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
Behavioral task
behavioral11
Sample
SAK CLEANER/Protection History.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral12
Sample
SAK CLEANER/Protection History.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
300 seconds
General
- Target SAK CLEANER.zip
- Size 6.8MB
- Sample260905-cpmv2a11dy
- SHA256 9a841bd65a0ec2fbdd7d5311cc9c658822140b4a8c5f146e6e4e7121aea1c69b
- MD5 2ec6fd00b7cc7bd0d132e6d25f2edde4
- SHA1 eb8ff3d92e3491e04f24dc1fe30eacd5a54b3fba
- SHA512 ff583eee921e2501bd01d672127f7cb30514b30401d0ccdfb91691279fff63420550e8a19cc800087bb4f01843aa92cdb76fb23aea5d0e691afbbf7c15b5ba84
- SSDEEP 196608:6ccDuq6JBeYtmhDXG9smRoZ0IZTnW5VWfP:6gqwqhDWSmGZ0IZTnqs3
- TLSH T15D7633ADA6B19AE7D29B3DD1C1D47AE44420CDC50F985D109B8F1EFC96AED00849FCAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/a�ې.��.pyc blankgrabber_exe - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/SAK CLEANER/Protection History.exe
File Explorer
-
SAK CLEANER.zip.zip 6.8MB
-
SAK CLEANER/1- Cleaner.bat.bat 1KB
-
SAK CLEANER/2- Clean.bat512B
-
SAK CLEANER/3- Del Logs.bat.bat 892B
-
SAK CLEANER/4- Del temps.bat.bat .vbs 1KB
-
SAK CLEANER/5- Last Activity.bat.bat 31KB
-
SAK CLEANER/How To Use.txt811B
-
SAK CLEANER/Protection History.exe.exe 6.9MB
-
a�ې.��.pyc1KB
SAK CLEANER/1- Cleaner.bat
- SHA256 7bdf3cfcd458fe5de706dceb5873343046e481233abe9f60ea63633d788027ad
- MD5 f3a60b82f758ea4e7ecb9ca473c1e99d
- SHA1 5393702183f27e9efbfd9434ba05b8449b36bfe8
- SHA512 f943e5674a2c7e611d60fd32a1a34886cbe3a61f44037cc504d27570c3d67ab2af74461441e1eb1bf67ac17c784e16d35dd3770f654efbc80e2278697ca3beff
- TLSH T17511F01420498A1733F39D74CB123158F69FF287791C89B1F062A4949EA93C5DDEEDE4
- MD5 SHA1 SHA512 TLSH
SAK CLEANER/2- Clean.bat
- SHA256 fc4ea2d360de896e3ae5ad1d7831fcfefdd18a2e7754ccf0d6271a034a4284c2
- MD5 1c8a46e47f30c1a94a451b4187e3d36b
- SHA1 0af19fe40e7f29acd282098c0c026281f193fe04
- SHA512 1c8e55d7ed79c07faa8151372fd25104ef4504c706bcd0891aac6ed3298baddb9ca042baa8d7a6bfc4526b15296bbe3636f9b287166777b41ba6acbbc30f6d41
- TLSH T125F07A1A35A8B23089759958CBEFB77B0CC4B041CB925E15E7C20175B598F63E627EC4
- MD5 SHA1 SHA512 TLSH
SAK CLEANER/3- Del Logs.bat
- SHA256 e1ef04bcff94fd02a606a6ab267027d4e799f9510b3f8cec32ed8dd32b5a6a88
- MD5 1a77a87536950f7b5bce7a7a81a00486
- SHA1 dd295dfa0ed012780204c4c3ca24c76ffb180bd8
- SHA512 abb0298fd2bd18aaf592751e81cda699078b45f304bb8efa15f845ced8fc12842e307b4e4ac3a041097b8b80970bfc4ffce17e7becb56ba377db665e028a91b0
- TLSH T1DC1190051D898A2233B6D5B0D7122144E66FF347781888B4F1A2A0909DA8284DEFEAE8
- MD5 SHA1 SHA512 TLSH
SAK CLEANER/4- Del temps.bat
- SHA256 e2d994abafba75f9fb698427ba9be5306261b81793c9ba94fb869cfe99602f68
- MD5 e9914643b2f2f92a459ea2b612a9b89b
- SHA1 461abd96494679cedb01e99558b93be75b3df4d8
- SHA512 08208161a70a98c5ff82f1971f494990d3105fdce5efc6a3620fbe6d5481d6db42ec8632441dae84aa6f0677c0d8392486c523c6717b1d4d41c0b31617000817
- TLSH T1DF11BB041E9A862623B5C670D7162207E65AF34F7D1886B0F19161909FA82819FFE6D9
- MD5 SHA1 SHA512 TLSH
SAK CLEANER/5- Last Activity.bat
- SHA256 7aa3e715b1d976cd58dd787d65f224f24cbfbb9e284a8a4d2363f0e26c5c2740
- MD5 decdb1972602295a30852730b21ec5a1
- SHA1 d22301ab7fcd9208da8a411e6f35642d8a921447
- SHA512 d03b3fca15b66f4dc39eb3e2fa852963fa11971f5a196c3974e2b411dd8793a9b555613a00ff98d826713c9a0f8cea8271c18186a4a35c4262704d625c73847a
- SSDEEP 192:TmNNTTpRTpAHR55fjX5FL0VYIFpmmMF6i5lMFmRlMUMFTiyiYYwQ0H1fDZn:4NTTpRTpAHR3fjX5F0VYIzUwiwoClrZn
- TLSH T10CE2ED8032D48A01E1B2BB21355A9C718FFBB3DF74D99E0B98D5790821AFA4DD0653F9
- MD5 SHA1 SHA512 SSDEEP TLSH
SAK CLEANER/How To Use.txt
- SHA256 09aceb161c46b7a0370c4351d5784ae04e2f4b5b30049c0e8c8ec41bb8ef0a5a
- MD5 4322a1c6dedc9a65bd7e52ad59ff196f
- SHA1 89a44962aae6f6c0362525b6d3c850fac9f3bfde
- SHA512 b5ae1333c9452cbed616f10d40cd778d0e8169722546fdeb478c8b6c9aef0dffe8881f6d9055b36ae84d966b0abe9f5649e582b8e69acb0525223a680262d95d
- TLSH T19401C213844FF26382C292F4F5005792BF58281677E705367CEB40083D9F26483616BF
- MD5 SHA1 SHA512 TLSH
SAK CLEANER/Protection History.exe
- IMPHASH 965e162fe6366ee377aa9bc80bdd5c65
- SHA256 09a0e5c2c745ecd52ec4bf8299276aaa46f1c18b2bf24d604d468fb281c8b55b
- MD5 430e457b35e7c66137c73b0eda76fd0a
- SHA1 03efe888a47939b680cc50074bac67a13d32ba33
- SHA512 b29941ca5a05d93f94d422cc8fd3782d7d0f0f3c5af3d7e8f574620db2b8d050898645090a5fdc9af392e710fb66c2f890c77cba1529b895f3dd6e38c1cade6d
- SSDEEP 196608:cW0ZYJYs5VeNTfm/pf+xk4dWRumrbW3jmzr:tJYcuy/pWu4kRumrbmyf
- TLSH T12876336973F008F2E9B329BDC5819959C631BC550B64CE8B43684AB91F27A904D3FF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
1c:e8:a2:11:19:9c:46:46:dd:ba:27:30:2a:5f:47:1f:9e:cf:c2:91:89:67:8c:e0:65:f0:bd:42:0e:db:56:c0
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
52784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
VirtualProtect
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=3, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=11, id=257, version=33140,
count=158, id=1, productName=Unmarked objects,
count=25, id=260, version=34808,
count=1, id=258, version=34808,
a�ې.��.pyc
- SHA256 d285b0b684bc94399ca5cf50b409ae4504257f9b01eb5a8fd546a9934d9f7c2a
- MD5 a5c8735adf48b3404e6be82bfdf30c29
- SHA1 d197f2b0160bf287bf9048ff61472510aea4d6ca
- SHA512 c0ecd7a82319a2fe72ee84fef35ea9d89891eb5fbb43652be0d20fa7df7cf9bcb1db892e1aad0b1814ab778dc5afac90df8e8649a76adfd79382f328a41bb88b
- TLSH T12B3112875262CE3EF8AAD37C913C4C9673E0D9E1FA0C6693280E517E9D64924F8525FC
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller