grandoreiro | 35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a[.]zip

General

Target
35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.zip
Size 4.4MB
Sample230406-2zn9aafe83
SHA256 97c00910940f43ed12c20466cac4541a2f874a42ae02dd7a4ff8b2c64499ffda
MD5 48b5cb1d010674c20e694d0e0104dfe6
SHA1 bcf1067aee782317f698995f8922e9b8dafb8d70
SHA512 10daf7a450588b28fb89cf89af985794b58ae8d209878f9928ce2eca8128b73b3d1c212060bc805735555e47fd2a9a1478030486b2af6091ac617dfb81b9efe1
SSDEEP 98304:FsJjRXnjkK+K9M9gOUh4ON+fGELYkA9wLpCMY2EK0WLRUCT4G3/w:yJjGK+Ke9i0GELYkA9wLpCMYngRPTZw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
static1/unpack001/35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a	family_grandoreiro_v1

Grandoreiro family
grandoreiro

File Explorer

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.zip

.zip 4.4MB
35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a

.dll 254.5MB

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.zip

SHA256 97c00910940f43ed12c20466cac4541a2f874a42ae02dd7a4ff8b2c64499ffda
MD5 48b5cb1d010674c20e694d0e0104dfe6
SHA1 bcf1067aee782317f698995f8922e9b8dafb8d70
SHA512 10daf7a450588b28fb89cf89af985794b58ae8d209878f9928ce2eca8128b73b3d1c212060bc805735555e47fd2a9a1478030486b2af6091ac617dfb81b9efe1
SSDEEP 98304:FsJjRXnjkK+K9M9gOUh4ON+fGELYkA9wLpCMY2EK0WLRUCT4G3/w:yJjGK+Ke9i0GELYkA9wLpCMYngRPTZw
MD5 SHA1 SHA512 SSDEEP

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a

SHA256 35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a
MD5 98ef8e5ef3bef928537d4fd25c53380a
SHA1 7d3255275bff63faa31bca7d2ec87ec4408151a5
SHA512 57fb7b746068f6a626f850d438acdeeeaf1e2f0c68e7ea0ed98082b3bcce914f5e050423ad0095e7d1268d6e9415ba12134a03b9a689b9533ccf13a9f940fd2c
SSDEEP 49152:0hha9qUyO2Dmpso/Xls3L1NRRuU0gjMAlwLhdBf7hd3RZHFTcTPfT56xnhY:0hw9qUy5G/VsbvREgKxVd3jglwhY
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Detects Grandoreiro payload

Minor OS version

Major OS version

Entry point

10187668

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

A0DB34FC6FE35D429A28ADDE5467D4D7 DbgHelpCreateUserDump DbgHelpCreateUserDumpW DeinitLightshot DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExportList ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath Function00001 Function00010 Function00012 Function00025 Function00033 Function00035 Function00036 Function00037 Function00039 Function00043 Function00056 Function00057 Function00058 Function00061 Function00062 Function00063 Function00064 Function00065 Function00066 Function00067 Function00068 Function00073 Function00082 Function00083 GetLoaderInterface GetRegisteredUserName GetTeamViewerInterface GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx InitLightshot IsInternetConnected JAVALI2021 MVDefragStart MVDefragStop MakeScreenshot MakeScreenshotByCommand MakeSureDirectoryPathExists MapDebugInformation MiniDumpReadDumpStream MiniDumpWriteDump OpenPages RegistryCheck RegistryCheckItems RegistryImportFile RunMVDefrag Scintilla_DirectFunction SearchTreeForFile SearchTreeForFileW SetRegistryItem SetTranslations StackWalk StackWalk64 StopMVDefrag SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymCleanup SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrW64 SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW UnmapDebugInformation WinDbgExtensionDllInit __CxxFrameHandler4 __NLG_Dispatch2 __NLG_Return2 __mingwthr_key_dtor __mingwthr_remove_key_dtor _libiconv_version block chksym dbghelp dh fptr homedir itoldyouso libiconv libiconv_close libiconv_open libiconvctl libiconvlist lmi lminfo locale_charset omap png_access_version_number png_build_grayscale_palette png_calloc png_chunk_error png_chunk_warning png_convert_from_struct_tm png_convert_from_time_t png_convert_to_rfc1123 png_create_info_struct png_create_read_struct png_create_read_struct_2 png_create_write_struct png_create_write_struct_2 png_data_freer png_destroy_info_struct png_destroy_read_struct png_destroy_write_struct png_error png_free png_free_data png_free_default png_get_IHDR png_get_PLTE png_get_bKGD png_get_bit_depth png_get_cHRM png_get_cHRM_fixed png_get_channels png_get_chunk_cache_max png_get_chunk_malloc_max png_get_color_type png_get_compression_buffer_size png_get_compression_type png_get_copyright png_get_error_ptr png_get_filter_type png_get_gAMA png_get_gAMA_fixed png_get_hIST png_get_header_ver png_get_header_version png_get_iCCP png_get_image_height png_get_image_width png_get_interlace_type png_get_io_chunk_name png_get_io_ptr png_get_io_state png_get_libpng_ver png_get_mem_ptr png_get_oFFs png_get_pCAL png_get_pHYs png_get_pixel_aspect_ratio png_get_pixels_per_meter png_get_progressive_ptr png_get_rgb_to_gray_status png_get_rowbytes png_get_rows png_get_sBIT png_get_sCAL png_get_sPLT png_get_sRGB png_get_signature png_get_tIME png_get_tRNS png_get_text png_get_uint_31 png_get_unknown_chunks png_get_user_chunk_ptr png_get_user_height_max png_get_user_transform_ptr png_get_user_width_max png_get_valid png_get_x_offset_microns png_get_x_offset_pixels png_get_x_pixels_per_meter png_get_y_offset_microns png_get_y_offset_pixels png_get_y_pixels_per_meter png_handle_as_unknown png_info_init_3 png_init_io png_malloc png_malloc_default png_malloc_warn png_permit_mng_features png_process_data png_progressive_combine_row png_read_end png_read_image png_read_info png_read_png png_read_row png_read_rows png_read_update_info png_reset_zstream png_save_int_32 png_save_uint_16 png_save_uint_32 png_set_IHDR png_set_PLTE png_set_add_alpha png_set_bKGD png_set_background png_set_bgr png_set_cHRM png_set_cHRM_fixed png_set_chunk_cache_max png_set_chunk_malloc_max png_set_compression_buffer_size png_set_compression_level png_set_compression_mem_level png_set_compression_method png_set_compression_strategy png_set_compression_window_bits png_set_crc_action png_set_error_fn png_set_expand png_set_expand_gray_1_2_4_to_8 png_set_filler png_set_filter png_set_filter_heuristics png_set_flush png_set_gAMA png_set_gAMA_fixed png_set_gamma png_set_gray_to_rgb png_set_hIST png_set_iCCP png_set_interlace_handling png_set_invalid png_set_invert_alpha png_set_invert_mono png_set_keep_unknown_chunks png_set_longjmp_fn png_set_mem_fn png_set_oFFs png_set_pCAL png_set_pHYs png_set_packing png_set_packswap png_set_palette_to_rgb png_set_progressive_read_fn png_set_quantize png_set_read_fn png_set_read_status_fn png_set_read_user_chunk_fn png_set_read_user_transform_fn png_set_rgb_to_gray png_set_rgb_to_gray_fixed png_set_rows png_set_sBIT png_set_sCAL png_set_sPLT png_set_sRGB png_set_sRGB_gAMA_and_cHRM png_set_shift png_set_sig_bytes png_set_strip_16 png_set_strip_alpha png_set_swap png_set_swap_alpha png_set_tIME png_set_tRNS png_set_tRNS_to_alpha png_set_text png_set_unknown_chunk_location png_set_unknown_chunks png_set_user_limits png_set_user_transform_info png_set_write_fn png_set_write_status_fn png_set_write_user_transform_fn png_sig_cmp png_start_read_image png_warning png_write_chunk png_write_chunk_data png_write_chunk_end png_write_chunk_start png_write_end png_write_flush png_write_image png_write_info png_write_info_before_PLTE png_write_png png_write_row png_write_rows png_write_sig srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

Name

CODE

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

244.5MB

Virtual Size

244.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.zip

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a