Overview

overview

10

Static

static

1

Archive.710279869.vbs

windows7-x64

10

Archive.710279869.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archive.710279869.vbs

  • Size

    18KB

  • Sample

    230410-nfmpfsha66

  • MD5

    e46c2a754c636b4c95c23760d72d2688

  • SHA1

    efd544914bcd66eecad3ec8c657f496ebc6b0c02

  • SHA256

    e2657715d8d2731cc784a82d87eee39115a66e0dd0a4a6093b24ee35c37ef170

  • SHA512

    5b069b4eeebbc52580afc51799cd3a86ddb3d747475b3fae56ec692d4d86ce896d2ed6a6961e8becec2e4711c97dd33223c3c0529f67fe9a5cad2b3b56b564ea

  • SSDEEP

    192:53JExmMuIYYz8YDyJZ3Z2yxekdfQY2fGV4:bEzuIYYz8YDeZp2yxekdXV4

Score
10/10
grandoreirobankerpersistencetrojan

Malware Config

Targets

    • Target

      Archive.710279869.vbs

    • Size

      18KB

    • MD5

      e46c2a754c636b4c95c23760d72d2688

    • SHA1

      efd544914bcd66eecad3ec8c657f496ebc6b0c02

    • SHA256

      e2657715d8d2731cc784a82d87eee39115a66e0dd0a4a6093b24ee35c37ef170

    • SHA512

      5b069b4eeebbc52580afc51799cd3a86ddb3d747475b3fae56ec692d4d86ce896d2ed6a6961e8becec2e4711c97dd33223c3c0529f67fe9a5cad2b3b56b564ea

    • SSDEEP

      192:53JExmMuIYYz8YDyJZ3Z2yxekdfQY2fGV4:bEzuIYYz8YDeZp2yxekdXV4

    Score
    10/10
    grandoreirobankerpersistencetrojan

    • Detects Grandoreiro payload

    • Grandoreiro

      Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.

      trojanbankergrandoreiro

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks