MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlankGrabber


Vendor detections: 12


Intelligence 12 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd
SHA3-384 hash: d59e6dd3f01a910a9f453f55cef805ff2b572e2c5eaafcd825596d856e038065c0b48d0afaa9f105d3f34a4ad1db0ba0
SHA1 hash: 6f73743f61238a9746ba9e6ef3b5bf495f22f4a3
MD5 hash: 8589b564a5ed7920be4b1b08f3d6d8ed
humanhash: charlie-fillet-six-nebraska
File name:updater.exe
Download: download sample
Signature BlankGrabber
Create hunting rule
File size:12'898'304 bytes
First seen:2023-11-19 12:25:03 UTC
Last seen:2023-11-19 14:20:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a9c887a4f18a3fede2cc29ceea138ed3 (33 x CoinMiner, 17 x AsyncRAT, 15 x BlankGrabber)
ssdeep 393216:W1pjCaVtz/VWvpxlAilDWT1IqWwLuMJrV50y9vDx5W:WdrwRxlAYaTWqWwLuM5VZvDx
TLSH T127D623A0B6C542E1C6AC8F7A271D3EE0499E709F44246CAD26D79328776231FD31FAC5
TrID 38.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
11.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 71f4a2cccc8ac461 (2 x BlankGrabber, 1 x CoinMiner)
Reporter Xev
Tags:BlankGrabber CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
446
Origin country :
GR GR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/459128/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.37392.29701.10925.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Sending an HTTP GET request
Deleting a system file
Creating a service
Launching a service
Enabling autorun for a service
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6559fea5c7c19cae469b8931/reports/6ad6ddc7-fb8c-455c-b032-e4a4571ed799/overview
Verdict:
Malicious
Labled as:
FakeAlert.Generic
Link:
https://www.hybrid-analysis.com/sample/e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b64afcf2-6cb3-495a-91c6-4580a3430efb
Result
Threat name:
Blank Grabber
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1344743
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
DLL side loading technique detected
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Removes signatures from Windows Defender
Sample is not signed and drops a device driver
Self deletion via cmd or bat file
Writes to foreign memory regions
Yara detected Blank Grabber
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1344743 Sample: updater.exe Startdate: 19/11/2023 Architecture: WINDOWS Score: 100 109 blank-dtb9o.in 2->109 111 xmr.2miners.com 2->111 113 2 other IPs or domains 2->113 155 Antivirus detection for URL or domain 2->155 157 Antivirus / Scanner detection for submitted sample 2->157 159 Multi AV Scanner detection for submitted file 2->159 161 3 other signatures 2->161 10 updater.exe 3 2->10         started        14 fgqgjrcfhjsu.exe 2->14         started        signatures3 process4 file5 101 C:\Users\user\AppData\Local\...\mupdater.exe, PE32+ 10->101 dropped 103 C:\Users\user\AppData\Local\...\gupdater.exe, PE32+ 10->103 dropped 169 Encrypted powershell cmdline option found 10->169 16 gupdater.exe 22 10->16         started        20 mupdater.exe 1 2 10->20         started        22 powershell.exe 23 10->22         started        105 C:\Windows\Temp\cmdqefywrmuy.sys, PE32+ 14->105 dropped 171 Multi AV Scanner detection for dropped file 14->171 173 Protects its processes via BreakOnTermination flag 14->173 175 Modifies the context of a thread in another process (thread injection) 14->175 177 2 other signatures 14->177 24 dialer.exe 14->24         started        26 dialer.exe 14->26         started        29 cmd.exe 14->29         started        31 7 other processes 14->31 signatures6 process7 dnsIp8 91 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 16->91 dropped 93 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 16->93 dropped 95 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 16->95 dropped 99 16 other malicious files 16->99 dropped 119 Modifies Windows Defender protection settings 16->119 121 Adds a directory exclusion to Windows Defender 16->121 123 Removes signatures from Windows Defender 16->123 33 gupdater.exe 16->33         started        97 C:\ProgramData\...\fgqgjrcfhjsu.exe, PE32+ 20->97 dropped 125 Self deletion via cmd or bat file 20->125 127 Modifies the context of a thread in another process (thread injection) 20->127 37 dialer.exe 20->37         started        39 cmd.exe 20->39         started        41 cmd.exe 20->41         started        45 10 other processes 20->45 129 Potential dropper URLs found in powershell memory 22->129 43 conhost.exe 22->43         started        131 Injects code into the Windows Explorer (explorer.exe) 24->131 133 Writes to foreign memory regions 24->133 135 Allocates memory in foreign processes 24->135 139 2 other signatures 24->139 47 3 other processes 24->47 115 pastebin.com 104.20.68.143, 443, 49709 CLOUDFLARENETUS United States 26->115 117 xmr.2miners.com 162.19.139.184, 12222, 49706 CENTURYLINK-US-LEGACY-QWESTUS United States 26->117 137 Query firmware table information (likely to detect VMs) 26->137 49 2 other processes 29->49 51 6 other processes 31->51 file9 signatures10 process11 dnsIp12 107 ip-api.com 208.95.112.1, 49705, 80 TUT-ASUS United States 33->107 141 Modifies Windows Defender protection settings 33->141 143 Adds a directory exclusion to Windows Defender 33->143 145 Removes signatures from Windows Defender 33->145 53 cmd.exe 1 33->53         started        56 cmd.exe 1 33->56         started        58 cmd.exe 33->58         started        60 cmd.exe 1 33->60         started        147 Contains functionality to inject code into remote processes 37->147 149 Writes to foreign memory regions 37->149 151 Allocates memory in foreign processes 37->151 153 3 other signatures 37->153 62 lsass.exe 37->62 injected 64 3 other processes 37->64 66 2 other processes 39->66 68 2 other processes 41->68 70 10 other processes 45->70 signatures13 process14 signatures15 163 Modifies Windows Defender protection settings 53->163 165 Adds a directory exclusion to Windows Defender 53->165 167 Removes signatures from Windows Defender 53->167 72 powershell.exe 23 53->72         started        74 conhost.exe 53->74         started        76 conhost.exe 56->76         started        89 2 other processes 56->89 78 WMIC.exe 58->78         started        81 conhost.exe 58->81         started        83 conhost.exe 60->83         started        85 tasklist.exe 60->85         started        87 svchost.exe 62->87 injected process16 signatures17 179 DLL side loading technique detected 78->179
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd/
Threat name:
Win32.Dropper.Dapato
Create hunting rule
Status:
Malicious
First seen:
2023-11-16 23:29:26 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
20 of 24 (83.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4oaeql6d3dcp4eihh6ltii4nmcvwmoc6gjqsge2y67icbavsgxgq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence upx
Link:
https://tria.ge/reports/231119-plnpdaag3x/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates processes with tasklist
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
UPX packed file
Creates new service(s)
Sets service image path in registry
Stops running service(s)
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd
MD5 hash:
8589b564a5ed7920be4b1b08f3d6d8ed
SHA1 hash:
6f73743f61238a9746ba9e6ef3b5bf495f22f4a3
Link:
https://www.unpac.me/results/0b54c5dd-1324-4379-a6f8-f41198ad9a2e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e380482fc3d8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:Windows_Rootkit_R77_d0367e28
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/459128/

Comments