blankgrabber | ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad

General

Target
external fivem.exe
Size 12.6MB
Sample260915-bxap1adc53
SHA256 ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad
MD5 b2c85c0b7a36d867804e96f1c1c14416
SHA1 f94d5028429e34e850dbc7d73556f79f866e4991
SHA512 3e65ac58e21ccb2fc5d14c7605c05ece2a0404881f21920b1add6d609c2831a8fa8bf5b2a4e4549edb4bf2baf6145eea97d5428ec1a37ec5ff84c64fbf4ef5f5
SSDEEP 393216:VeGLk0Ph1dEeN0L0mrH4Nd8HsnvDwHReQl54W:VJXdHNy0mrY3+gEHgzW
TLSH
T1DAD6337623D50AFAF4AA207E7B65C307E72178125BA0E5CF476417292D2B9F84D3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  external fivem.exe
- Size 12.6MB
- SHA256 ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad
- MD5 b2c85c0b7a36d867804e96f1c1c14416
- SHA1 f94d5028429e34e850dbc7d73556f79f866e4991
- SHA512 3e65ac58e21ccb2fc5d14c7605c05ece2a0404881f21920b1add6d609c2831a8fa8bf5b2a4e4549edb4bf2baf6145eea97d5428ec1a37ec5ff84c64fbf4ef5f5
- SSDEEP 393216:VeGLk0Ph1dEeN0L0mrH4Nd8HsnvDwHReQl54W:VJXdHNy0mrY3+gEHgzW
- TLSH
  T1DAD6337623D50AFAF4AA207E7B65C307E72178125BA0E5CF476417292D2B9F84D3A730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2