blankgrabber | 48a271de3a38c251bb304c9863934e856dfcb4d3839099f59f35529ad8df8ce1

General

Target
Cheat.exe
Size 12.0MB
Sample261113-yr2b4af13x
SHA256 48a271de3a38c251bb304c9863934e856dfcb4d3839099f59f35529ad8df8ce1
MD5 a2a575b23d336bb58f2c8f7566d293e6
SHA1 d38c38486b07ef4557c9eff123251ce89bf4eecc
SHA512 4e31914eddaba20f4b4946228ea28fef2bee5d9bf4b63d14839f0ba47fa6fd29820a36d7f42888c6544333651d36b07a24ff590ac8394d9a7bbb64a4587a1650
SSDEEP 196608:ERHCzrkOcwtyjp7qejDFE3XIJa2LeYnoNtK5CwseRqwC25vEQpmvUp:7zrhyjPZE34Ja21dLseRqwCOr
TLSH
T1B8C63355C3C012E5F4F2D27C8AA2D152EBF2B9005FF6C1DF0999532E2D67AE0253DA98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Cheat.exe
- Size 12.0MB
- SHA256 48a271de3a38c251bb304c9863934e856dfcb4d3839099f59f35529ad8df8ce1
- MD5 a2a575b23d336bb58f2c8f7566d293e6
- SHA1 d38c38486b07ef4557c9eff123251ce89bf4eecc
- SHA512 4e31914eddaba20f4b4946228ea28fef2bee5d9bf4b63d14839f0ba47fa6fd29820a36d7f42888c6544333651d36b07a24ff590ac8394d9a7bbb64a4587a1650
- SSDEEP 196608:ERHCzrkOcwtyjp7qejDFE3XIJa2LeYnoNtK5CwseRqwC25vEQpmvUp:7zrhyjPZE34Ja21dLseRqwCOr
- TLSH
  T1B8C63355C3C012E5F4F2D27C8AA2D152EBF2B9005FF6C1DF0999532E2D67AE0253DA98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Reads clipboard contents
  Reads text or data currently stored in the Windows clipboard, which can expose copied passwords, API keys, or sensitive text.
  collection
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  stub.pyc
- Size 162KB
- SHA256 85f10bca6427944cddbc2b5684da39ace43b5b77938d2df6791c699b86de11a5
- MD5 0004f61221ad85d9b2bfa71482637bff
- SHA1 d1ec7c2c64e93a806cdab9e2281b7d70ee500edd
- SHA512 cee1d45d0c4d928ab038c1f7f252e6b6a24a50b90092dcc8425bbdaf64f9f3b7384b76cd9d69993ee8e65882756375c7252093b1aed780c6f6216773e0bea06b
- SSDEEP 3072:Wi/WpjvBc7i3cVZ8jOiAKluP0vEluaVbE:WWUjvBmiMv8ZACvElI
- TLSH
  T175F309789A70AA2FF9DCF03831D6AA85F3368246B601C707F12888797CDD3819E7565D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4