Behavioral task
behavioral1
Sample
23fac75e5f18c5a2a955e0faade984de4266a3b770a1c34a252cbf6aaa0d7e72.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23fac75e5f18c5a2a955e0faade984de4266a3b770a1c34a252cbf6aaa0d7e72.xls
Resource
win10v2004-20221111-en
General
-
Target
9125264495.zip
-
Size
465KB
-
MD5
cc5ce3977b79fbdc49c5a03406a4c2a6
-
SHA1
059e887bd5c89dc543182adf9e89e9a24c048502
-
SHA256
9b24b1cb68f62fa5abb989e5fe44e8a4e0108c779b7f424b4995a69fd1b063ad
-
SHA512
6499f81531169fc869f23d53bc663ff15b703ac5bd9625da60ce36d03691b5ca2154411e7172e6493c2a3cc070c8c1149f98bb9f5ea4a66dc2efaae083ad61cc
-
SSDEEP
12288:05gM/33Snog1VmSnF7U1ZNk0NUQYZU5om7jDFMQ:OgMP2vHmYZ6k0NUQWU5J7jDL
Malware Config
Signatures
-
Document created with cracked Office version 1 IoCs
Office document contains Grizli777 string known to be caused by using a cracked version of the software.
resource yara_rule static1/unpack001/23fac75e5f18c5a2a955e0faade984de4266a3b770a1c34a252cbf6aaa0d7e72 grizli777_cracked_office
Files
-
9125264495.zip.zip
Password: infected
-
23fac75e5f18c5a2a955e0faade984de4266a3b770a1c34a252cbf6aaa0d7e72.xls windows office2003