blankgrabber | 9f176cd2985f358599a6601b5dc5e5c42bbee1df5ec774bd5d46dc86a3ee74ef

General

Target

Alpha-PVP.exe
Size

6.9MB
Sample

240706-jamp2szhrq
MD5

6481066b6efa17d708c9287ae796663f
SHA1

24ee71cd0ee76b5866990f7e1e30c58c0add8c4c
SHA256

9f176cd2985f358599a6601b5dc5e5c42bbee1df5ec774bd5d46dc86a3ee74ef
SHA512

42ed7c853e580203acd137799461a2b5b4593483b91f36d8887ab8415250a7fd4f64216259d9f98b6becae3de5a676369a6abc29d909e0718bff14f951ae8133
SSDEEP

98304:NuDjWM8JEE1r3oipamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEb:Nu0/keNTfm/pf+xk4dWRGtrbWOjgWyp

Score

10^/10

Malware Config

Targets

- Target
  
  Alpha-PVP.exe
- Size
  
  6.9MB
- MD5
  
  6481066b6efa17d708c9287ae796663f
- SHA1
  
  24ee71cd0ee76b5866990f7e1e30c58c0add8c4c
- SHA256
  
  9f176cd2985f358599a6601b5dc5e5c42bbee1df5ec774bd5d46dc86a3ee74ef
- SHA512
  
  42ed7c853e580203acd137799461a2b5b4593483b91f36d8887ab8415250a7fd4f64216259d9f98b6becae3de5a676369a6abc29d909e0718bff14f951ae8133
- SSDEEP
  
  98304:NuDjWM8JEE1r3oipamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEb:Nu0/keNTfm/pf+xk4dWRGtrbWOjgWyp
Score

8^/10

defense_evasion execution persistence privilege_escalation spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1
- Target
  
  �S��P�.pyc
- Size
  
  1KB
- MD5
  
  2405aa53e2d22db5ec1616d291dd3e01
- SHA1
  
  422c9a04d8e5d3b26869210ffe413930703c8a77
- SHA256
  
  77aa17026e9d40a6b9447f762743872b49d81eb7c763356dacab3dc76918a87a
- SHA512
  
  8f1f216eeb3171a320b8d6e276868c2fe1eb7a7532abf38dff256ea68f82a928e7443fcf3317b19c3a75c0735e7f453a436ad2778b39fc0b291e6579213beabc
Score

1^/10
behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Hide Artifacts: Hidden Files and Directories

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2