blankgrabber | d7b8efb5c0be7b1c74f976c4e9dbfaf6183d4e574a76864bdde33addc7f81da4

Sharing

Copy URL Twitter E-mail

General

Target
New WinRAR archive.rar
Size 30.2MB
Sample261113-msbx2saw9j
SHA256 d7b8efb5c0be7b1c74f976c4e9dbfaf6183d4e574a76864bdde33addc7f81da4
MD5 ef89879c9eab6857f7638b3399d361e9
SHA1 05ef3e863455bae1c445c1f9eed9642844530241
SHA512 a4890bce12dfe48b8a50e20003eb2d1ce3160ee4982ced0a70abfb5a39d7a43ca43c232f6a5b0f6192518f2b81a176641c49671501baa648dc470de13a36b8f9
SSDEEP 786432:wbyfouo+oAfTDw6TROOmqlEdjdzya/Z6xgpB9QywSumc9H:9fo+oAfTs22hd+K6x2SSQH
TLSH
T1A9673365FC142BF70292415E211BDBAC0E24F110C91EFF2AA8BB161937057FA5AEC776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Components/stub.py
- Size 91KB
- SHA256 ead83b3024866f941b2b89ecfea16b04f5ed26daec495d450aa428e29ca4c66d
- MD5 74ade4c447eb95c5f827c2ab6c01d2e5
- SHA1 e88b5a1c2b79035ef2ab25c67c0d05d7959926e6
- SHA512 73fd8d3d4745ba0a9cc9dfc2e3988974977a50f559c5f7c391f245d11bba42f08f9ac9c6036bc5db5ad947cb467f1e32ecb5ad35b031dd3ea50138bbab476e4d
- SSDEEP 1536:UZiLDiuxfkGR7BU7s/U23D36aaXlIAVcnaaU5ufqXf3CFAkHLqDV9pEFLEfT:U7GR7BU7s/73Du3OAkH69YLEfT
- TLSH
  T19293C62ADD2A181692B3D78C6942D5D2F70C8753DA231813FEEC96047F35990D3F8A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  IttihadRAT v1.2-decrypted-cleaned_Slayed.exe
- Size 19.1MB
- SHA256 364a8cd6be04ab77ce11ff260d003254a96cd831ff306a27a8b735d7a26a81fc
- MD5 ae2469623bf285422fbd73384c384de6
- SHA1 66b79ae4d877d0c600f6f84c51d98e455791739f
- SHA512 c0914e829ef8901664c2e6652a3b3fb7fa33c3147c943459c78977f3eca069157e85b0b3f9e610d8feca47a7477b3b7d1e0931da0a2e617ba5b40e7093a82c7c
- SSDEEP 393216:/APalGYFMNM5OgUpYzuIecBKG0boNTGnNAQHgr1jMglBx8t:+akYoM51zHtebQTupAus/8t
- TLSH
  T12B17333837E39A27E095577B0556A945DA79CDF26307730B3DC4B21B2CA2B0D4B822F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Plugins/Chat.dll
- Size 24KB
- SHA256 e13bd48c0cc1041e991aba780f49366142a59edf76889cc518d87508113229ff
- MD5 715873a8af3f7e6ca5ad655a7f7fce20
- SHA1 4a1eb56d11091c1e0221c3cd72d5a9f4a785bb36
- SHA512 b3ab394b2239a5af5cc167588ed582336a9d363f855e22c2d8e71fe533784e843d350c6b90fca07061482ee7307efe90c5644b558e354d25e25718830f88cf29
- SSDEEP 384:BUIVjPmmjJz7mD/PT0UzkoiEEEEEEEESEElAEEwXEE1OvBhfgV1pLr+zAHMaC8Zm:vVLRjJ2Dj00OhIV7iEzih
- TLSH
  T122B22904A7A8C73BCFAD0BB9A477521807B2C22B6503EF955DDC50EA5A177CE0742AC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Plugins/Extra.dll
- Size 29KB
- SHA256 ac97863ec874bb62f3fd168209ef35670b6cd9d42850f13aee57b5022c044818
- MD5 25ae0ab0846697abe27d6b502a652eee
- SHA1 ea6cb7c769b8dea7a70b18dd75803fcd3a3cabca
- SHA512 abf1e152b6031462f2048b7c0b182baa390fa9d93976e19408cfa8f5d67d19b25fef097acb962509b5e3127ceb4b7835396c27576d21d51246b5ca365282c62b
- SSDEEP 384:/XETRbFmmOFgTNv7/dseXG07xEDgS7B30uBstoui1QyLp0L7amE:/McmOFg/FE0OLmyLGamE
- TLSH
  T14FD21A017FE89667F67D1B349DF313088776F89A7903DF4E4C8020AA49237C95A217EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Plugins/FileManager.dll
- Size 30KB
- SHA256 5e8e62da362fa239b4393a7d1df7cb5ce95adff03260db831a6f6749cabd855f
- MD5 581fbba705cb144d7e314a92ae8f0d0f
- SHA1 e2a3b771a9ee4345a45577bd4ca5ff70cf377428
- SHA512 a77b8d69363622238485d6faa295d0004065fdda2adde1dd66c9e02f19777a210fb0d7d896719c39f1bb71c5453693d6371c2e5f4b41839f98e31a880322aee3
- SSDEEP 384:NG7GeJ/d/D3gfmjLEzCHJC74dseXGDssEDg8mquuU8OVYlVUMza1QLuwbXMQMWX:NQ9d/rgO/Vi4Y4pUHC/XSUXMjWX
- TLSH
  T108E20914BFA4D653E77C4338A8B3231C02F6906B6252EB4B9CD521F11A2B7CA9611DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/FileSearcher.dll
- Size 123KB
- SHA256 a8a3589b13896feca1efa37873d34465b2f59ee335ebdebdb3060b55504efbdc
- MD5 4e423dde700a48a023025917632b4ba3
- SHA1 bd217df54a5a73b8b9b5f5cf07c9210a1d30d799
- SHA512 9f0e4defde62bc4e1debfea14e55281a393c1a10a23c613500ba8c33aab939e0be8b31814cf68df1f28cc951f86c8a8165b1807c5ff96bdfaa43444502c06270
- SSDEEP 3072:PGGaSHMdcvIe3NFJutuI0CSXVGB9yDXcfTwvd/H:PGHSsdqjJiulCcVWimsd
- TLSH
  T165C3029863A45F93D1BA87FC3A7263809AB9D507B501C3C5ECC860C65F1A7D3AB74C92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plugins/Grabber.payload
- Size 233KB
- SHA256 d3f7e225d4141f37c7f15c146176247180a84714456a4583c80d9d9bec4d4ad0
- MD5 7b3a8d85be96e31fbc784302c4563c47
- SHA1 133e3b6b9847e7724273a92446d04f7d0b8a4791
- SHA512 b1f2124a25eca63dcdf7cd76d5a1df67f8e6c53ae719ac36350ba369e5f06c729ef6c90b065854c4892f1cd827952e9c8d02bf26bb5c71e3afd1978b5dd64a9c
- SSDEEP 6144:k6XeHyvlG8YAPEi/8edJ856fTF32q2qh4/+KG6hSDu8e3OpzY:9XeHyhYAPEi/DJ3rv4O
- TLSH
  T1BB346D4453B4DF31D3AFCBB45560456B8BB1F10BF50EFB8E4D849AD92827742A880E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

umbral stealer
- Detects Umbral payload
- Family: Umbral
  Umbral stealer is an open-source modular stealer written in C#.
  stealer umbral
behavioral13 behavioral14
- Target
  Plugins/LimeLogger.dll
- Size 25KB
- SHA256 181aa268ae0d1ad19acf1c9ec7df3758f5692cfac11290185365884d1d941c39
- MD5 0cfc03fa0ebb38cf8c51388501edf5c1
- SHA1 96e622d133786fdfc0b55cec873258ff3871fb70
- SHA512 30a404a74ac4965024d12d91c3e2850b95654d37d993724ae49eed21942c295f885344e09f02b35f9b8d51f48232aeff0f43a9281026d91eb7a206e91942d9a4
- SSDEEP 384:KgXy4TVo1a1/mbOqB9btOKPdseXG8IdEDggu1LBsWwQgrnbfuaQV:Ka1uqqrPZDKpQrnjuN
- TLSH
  T144C23A057F98C7B7C6AC17B8ACB7831643B1D1A66C13EB875C9810F60A533D75706ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/LockApplications.dll
- Size 10KB
- SHA256 20a28a50e694f840461a2b7a089114d6356af61a097fefc36727a9c2d395ba4b
- MD5 8183c705b0b6161270cbf9156be74d73
- SHA1 1332b8b5c54d2ba20cd2dc713f6abd4b9562bdac
- SHA512 725530e11a33a7503826d7660cbb258ca429f06c6684b4f7abe7b96cfedef93b38fd946fd1e6f1aead9e0133506fecca14df8509638e67f297a0eace4ff55905
- SSDEEP 192:R7QHqDQqpMrGO5ib1EiTxIW1Pn/+kMpC0ewL2H:RWqH+qqwFTbn/+kMpC0iH
- TLSH
  T1AA22E925E7E44275DDFB1B726CA362410775FD088D23B72F1DC4B0661CA36958BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/Miscellaneous.dll
- Size 90KB
- SHA256 96426f9b6d59264a69831a2cb89e56697a678e2ef9559f58cf084673d38b4595
- MD5 612f31a94270f6b880b95624df406eff
- SHA1 ecf15b7f1aa1b629747c843f50c4ee8b19350fa7
- SHA512 4e41ce4e53a2553aef98e187f88a2e5d942acb93b69ffaab7c47f08c1bc959e247fb875fb55276781e0453ded852c35279c7a9b9b4fb512ef82f5b37a2a92717
- SSDEEP 1536:4/uamNPCs3SvpqnS99qYofrWV2klnn83OQ4Qfh0Vu/7NFuMko0DC:ramNPCnvUTKV2b3OQ4QfhYu/BoJvDC
- TLSH
  T12F936E186FD4C92AE5FF8BBA31B2194843F1D056A523DB4E5C9420E65F633820B277DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Plugins/Options.dll
- Size 27KB
- SHA256 ec3113ecc436c81242b8936a6d366f3baa2f47f9bfee8b61030229083d12995b
- MD5 56b95a89484b49342f9d6ebe96c30661
- SHA1 92ff33a5d79c74513be24d3debcfb0a672a20bb0
- SHA512 416a8c460fdc8fcb9fa110ba4ae5763a911022a972a920d7160514e67cbb49141e34ad4dd3f9d3405b0051bf7cf2baaf9a0164da11a66e7a7c20419e010da2a7
- SSDEEP 384:L5A+KmSrODx5w74vdseXGZcbiEDgs7+dz6XRcy5R8FUYSK5MC4DH6lMkRNsB5G:L6mSrODxi4vC89nKF3SK5onkPp
- TLSH
  T197C23B01BBA8C7A3DA6C5778A0F3530103B4D55A6543EF8A5CE920FA4F137DB1A127CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Plugins/ProcessManager.dll
- Size 25KB
- SHA256 b5805ebc25c972fc875632c0e54f2e68255d932f4c07a8a07e216882f4659058
- MD5 21a3cfdbc903eadd7602a89230b13df9
- SHA1 1e82a236f55fdc8f88189ff584c5246b36ba68b1
- SHA512 8965d0355e9c9d4ddcfbee4192e8991f67b7560b0545f34dffa89e831be9ec5344e7803fa66615c8a0c6ed2d0c22b53ce650a7b00efe367f54dd6831284bc436
- SSDEEP 384:Q1y3xGUfJC71mIT33T9OZNA8z/CguRvDPNHdseXGW2OZDWl9UZUQDBMqhuoNokof:Q1y3gSC4IL3BS/UvDPllUoNeslgL
- TLSH
  T18DB23A056F88E777DABC077AA86353184774C1B6A502EF8B5CC824F26B077C91A147DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Plugins/Recovery.dll
- Size 263KB
- SHA256 89023945df7db3f454c9d0778b437990da95310aebae76a8dfa788e7e94f094b
- MD5 b12f2c89ed4f2ae00b1e3a1d8649ae25
- SHA1 bd12e18d60eacc4d3fd1fe26a23b89268b10f645
- SHA512 4c27a41142da281fd8dbda2edde0afbe4666b0e771c5664c6459b44a9e398ebc413c22d19ae3b97adff08dabfc41d5cb20d64a8d6fe5330d5369d624b8e12df2
- SSDEEP 6144:9MMCsd4t/cdcR1KcBitApmdHJxnVuGGCGxg0yyXTTEppK:g5ZRJBitCmdHJxVMK0yEEp4
- TLSH
  T1EC44126923EC9917E7BD4EBA947B4420877372536E10DA4B1FC5A48F4A33B934720B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Plugins/RemoteCamera.dll
- Size 59KB
- SHA256 a98ac3cfbb973e03a78dd82f184214a75ed261b05c3584e18151aa79c0b6301b
- MD5 9bc58526e985b80684595638ec7b120c
- SHA1 74651d580ddf2a3e18797f8c75afd0392c86e241
- SHA512 d8730cfda641ece4d5ba6a472c783814926939a0ddac9ea3a0ed8ad43d0ff15e3d32e08ed2459f1564d944e68b31ad44d45d60ad62020aab061e8e831795e33d
- SSDEEP 768:IUOIAr5LNpEuAtgbJWU3lJfOZKkcxb6aLBZRuA22z37n5FfWPSGoJp4WIMwM/IRh:IFrhMuZJGMku64RN3C0JFIMwMJ8n
- TLSH
  T1F9434B956BACD573F69D07F5A8770B000775C49A2013F74BAEA861A92C33B844E1A7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Plugins/RemoteDesktop.dll
- Size 34KB
- SHA256 bbf66fdc351e3d0071b33e8ffb186bfaf4920f5128d247d60f06ff732b916fc9
- MD5 02ac0dc2ea2c29298cb2cfce7a9cca62
- SHA1 f38543b130600a73b7b8289f354a61eedce5218a
- SHA512 92a7d9689e9c8f85be5cc15cb17b2128ebf25483404f92ad52307a83d06796bebefdc5e98fbd4d04e16301f3b648a3fadcdf2b962665d75460226894f551ff03
- SSDEEP 384:hcNHynhWZJKvOD+XkmVa4P8s1/NRdseXV2paBEDgjDJGLwV81cEmCyPUcc2kMPK9:hcHyn0ZMv5/Va4FRZcWEchC8Pr4Xh
- TLSH
  T12EF21700EF58C677D7AC43B9E8B71354437EC5A66403EB8B2C9400F52A137CB1EA96DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugins/SendFile.dll
- Size 25KB
- SHA256 024942b726379b8e1c40c9676e611cde38f131a2333936d909a08f65fdf308cc
- MD5 f42508f71a8e70e0042a4fc3d1373dc7
- SHA1 71dfe476c012402e71dac771b467d1086fdf7bd8
- SHA512 5bc78e5895f0106c8ca56ecda5fbe3554efc8f2e04648ab043125c58c48079ac5b66f085f1b67f477beae273299331f1a16f86b5699e2ad811743ac05e7a58de
- SSDEEP 384:02BaZm6a5fmmdKEKl5h+dtu5dseXG+snEigu7vugRWhTh5tzsu8i+5icyKAAb:5qxacmdRu5PQNWN52Fmj6
- TLSH
  T125B22905FF98A663DB7C0B38A87313090271E56BA913EF4E6C9810F74E137CB5A11AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Umbral payload

Family: Umbral

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32