grandoreiro | 220521-p5wjbsgfg5_pw_infected[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
220521-p5wjbsgfg5_pw_infected.zip
Size 5.6MB
Sample230329-retcdsgf36
SHA256 9555dca4e729984349b39bbd5d21042dc586dd7b081a07c2d6fdc7227818f1e4
MD5 4ca75382f363662dd5aca2fcd296ae05
SHA1 06fd790d4b2725adf918640ca7ceed5f33f7c46e
SHA512 ed9fda1c73429e2f653e450a68faea472f7f0b97c51cdb672089288e654dc76b03d80de2c78b93d1e790dc1349c8f9d434ad904d58c8b27f0df07546d823e969
SSDEEP 98304:kxB2QeIbKCMd1ufP3648VrTFdlbg0d4sGJJi8v97aZBkQ9bEAB1CkltwPnF+B1lf:a2Qe1XPs36461dZa5v97ABkQ9bCkl6AZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

grandoreiro

Malware Config

Signatures

Detected Grandoreiro 1 IoCs

resource	yara_rule
static1/unpack002/Adkflgog.exe	family_grandoreiro

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
static1/unpack002/Adkflgog.exe	family_grandoreiro_v1

Grandoreiro family
grandoreiro

File Explorer

220521-p5wjbsgfg5_pw_infected.zip

.zip 5.6MB
b9d264618be696cd1bd4ce420a573cc9778fbcf32bf79ca28172858b1795f093

.zip 5.8MB
Adkflgog.exe

.exe 193.1MB

220521-p5wjbsgfg5_pw_infected.zip

SHA256 9555dca4e729984349b39bbd5d21042dc586dd7b081a07c2d6fdc7227818f1e4
MD5 4ca75382f363662dd5aca2fcd296ae05
SHA1 06fd790d4b2725adf918640ca7ceed5f33f7c46e
SHA512 ed9fda1c73429e2f653e450a68faea472f7f0b97c51cdb672089288e654dc76b03d80de2c78b93d1e790dc1349c8f9d434ad904d58c8b27f0df07546d823e969
SSDEEP 98304:kxB2QeIbKCMd1ufP3648VrTFdlbg0d4sGJJi8v97aZBkQ9bEAB1CkltwPnF+B1lf:a2Qe1XPs36461dZa5v97ABkQ9bCkl6AZ
MD5 SHA1 SHA512 SSDEEP

Password

infected

Adkflgog.exe

SHA256 7e52fc679c8ca6e2e670598bd60263dbd5bebe4a37ae2ed03834a44acaa4f680
MD5 97a5caa44ad8eb614b98707ff6f32d72
SHA1 2546d75510b3bdc031277a50f5fa230514bd32e9
SHA512 5b5fa170e3802542bfa540ec2939b3687110903eb57fd08c2e3bf0ae90d103ff0d6fcf33d65013c87b2ee39d5bb8a8c6afe4c42f2e2d49d2ed3ebc01f72c89d3
SSDEEP 49152:BmN/STYpKg0fIjwbYRaY9AVFsU/FjX7LIGII11UgegV5Y0WTJo0qudB6ipq3zIVw:BmA9gGqXa8U3brRtsNxDmu1XuUO3
MD5 SHA1 SHA512 SSDEEP

windows x86

Detected Grandoreiro
Detects Grandoreiro payload

Password

infected

Minor OS version

Major OS version

Entry point

11359456

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

182.1MB

Virtual Size

182.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

220521-p5wjbsgfg5_pw_infected.zip

b9d264618be696cd1bd4ce420a573cc9778fbcf32bf79ca28172858b1795f093

Adkflgog.exe