Overview

overview

7

Static

static

3

TyrantGrab...er.exe

windows7-x64

7

TyrantGrab...er.exe

windows10-2004-x64

7

TyrantGrab...er.pyc

windows7-x64

3

TyrantGrab...er.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TyrantGrabberInstaller.exe

  • Size

    19.1MB

  • Sample

    240630-1xp75axajc

  • MD5

    a96014ccd9b29b2056d4cd8de8df4fb4

  • SHA1

    903f9c7e65f59536f703c1266b956651226b797f

  • SHA256

    488791938a891c2a68efffa2958a1e9da2899c40bd8dde2a81614517a3e15945

  • SHA512

    ae67e30bab7b26732a63c564b3b76f027aa8b0f105e687d97ed6095701b802cdfc566a1c42c373a1ace4763af365cd8f1b4e342198c5b2b35e92610f52e66b8c

  • SSDEEP

    196608:iooMmDnUkMm2Wm0sKYu/PaQDq9BIEcmtS9eNkpYfMQcYNnJSFmEPh2Qz2znPO1kY:Vo9DF23QD9etSmhMQZJ+h2zGfdGHs

Score
7/10
persistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      TyrantGrabberInstaller.exe

    • Size

      19.1MB

    • MD5

      a96014ccd9b29b2056d4cd8de8df4fb4

    • SHA1

      903f9c7e65f59536f703c1266b956651226b797f

    • SHA256

      488791938a891c2a68efffa2958a1e9da2899c40bd8dde2a81614517a3e15945

    • SHA512

      ae67e30bab7b26732a63c564b3b76f027aa8b0f105e687d97ed6095701b802cdfc566a1c42c373a1ace4763af365cd8f1b4e342198c5b2b35e92610f52e66b8c

    • SSDEEP

      196608:iooMmDnUkMm2Wm0sKYu/PaQDq9BIEcmtS9eNkpYfMQcYNnJSFmEPh2Qz2znPO1kY:Vo9DF23QD9etSmhMQZJ+h2zGfdGHs

    Score
    7/10
    upxpersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      TyrantGrabberInstaller.pyc

    • Size

      74KB

    • MD5

      515bfcc258935bf398c60fdbffbb903c

    • SHA1

      c155700f640e50cba218fedd9d2b20846099453e

    • SHA256

      74327fcc2d900b611c739c4f33846e17fea25135eeec5a16c189f9cda0c1f559

    • SHA512

      1f0a3f05e9126c1642ba95408ffc72a0d9cc6fe2e66ed8f01c0871e9f49c8a99cc1c30c5e7128d12325ce4e4734b5ceedf9d6194f0ebf0e34d68be3f47c69b5c

    • SSDEEP

      1536:CKjZq1Wa/hYx/Ys/A/ki5wD66lbcaMrW5N0Y:CAZkWa/WdCsi5ku6D

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks