grandoreiro | 5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686

Sharing

Copy URL Twitter E-mail

General

Target
5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686
Size 5.3MB
Sample220201-hkvb7saha3
SHA256 5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686
MD5 c70e96aafc3255b531e10d31df631987
SHA1 85031eb201da348b6897ed74a38b7c1adda57569
SHA512 a77f634882a59ce18823f7d4b81ef6df14434111b057b1bd9fc2b8a216771d67e59f6211c9051708cfde7ae3cd3ae863a884dfd622675f689eb5cd2cf934c42b
SSDEEP 98304:JvznTxWlIbCs/X+nLc+ku19NNl4+xVFW1wCputuIVcJWSP26DYZefF1onIZ:JLnlyTnWg3l4QVF0GwIVCO600fMnIZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

grandoreiro

Malware Config

Signatures

Detected Grandoreiro 1 IoCs

resource	yara_rule
static1/unpack001/DNultraCH95.exe	family_grandoreiro

Grandoreiro family
grandoreiro

File Explorer

5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686

.zip 5.3MB
DNultraCH95.exe

.exe 320.2MB

5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686

SHA256 5274e9f69c202d8312d829a11d595b0acb9f32f21f4ad907792b301737238686
MD5 c70e96aafc3255b531e10d31df631987
SHA1 85031eb201da348b6897ed74a38b7c1adda57569
SHA512 a77f634882a59ce18823f7d4b81ef6df14434111b057b1bd9fc2b8a216771d67e59f6211c9051708cfde7ae3cd3ae863a884dfd622675f689eb5cd2cf934c42b
SSDEEP 98304:JvznTxWlIbCs/X+nLc+ku19NNl4+xVFW1wCputuIVcJWSP26DYZefF1onIZ:JLnlyTnWg3l4QVF0GwIVCO600fMnIZ
MD5 SHA1 SHA512 SSDEEP

DNultraCH95.exe

SHA256 f71aac9591188dbb9648a9b82e0203acb1199645efb9fdbee62d1bf21ba9f3a9
MD5 a5df4e071c950d303e4c1aacb53308df
SHA1 b171944c658ca9d0f774d96d7218bfcb416ab924
SHA512 7d0ff593041dcadfc689f8a4ace64fe511c1cd88d3ed4dfe0848ef590e881a1eeb750aba3d0cc6ede6f4baf6aa26d97e263ce37e9137c07f9c9b84745e9caab4
SSDEEP 98304:cI2row0IeWT5fUxs0w2N9yUNiFw21tFD:cRrD0JW9vT2N95Nw1tFD
MD5 SHA1 SHA512 SSDEEP

windows x86

Detected Grandoreiro

Minor OS version

Major OS version

Entry point

8140464

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

36B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

312.2MB

Virtual Size

312.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ