Behavioral task
behavioral1
Sample
Rose-Grabber-main.zip
Resource
win10-20230831-en
General
-
Target
Rose-Grabber-main.zip
-
Size
2.1MB
-
MD5
14a33377fd0e21a5f6543ff311763f66
-
SHA1
1e08889d9d1a993a008572964a6db1f60c60edb4
-
SHA256
48c74ad01857829bec344dae32a3b86cbbec6e72ff237f803e8613eea9700fba
-
SHA512
aa65c5951b7806ea894001519666190b399bc5592999c8b23fe51f32d4f4c91d0de8f3be4d996047a9f1d318079f0413dcf13d7b61227a390289842050521001
-
SSDEEP
49152:zqEHtMm1IpFG2Z76j0E7kDhx/ZzpW37E9DE:eqOh76j0EmxG3Y9I
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx.exe unpack002/out.upx
Files
-
Rose-Grabber-main.zip.zip
-
Rose-Grabber-main/.bandit
-
Rose-Grabber-main/.deepsource.toml
-
Rose-Grabber-main/.gitignore
-
Rose-Grabber-main/LICENSE
-
Rose-Grabber-main/README.md
-
Rose-Grabber-main/components/assets/Rose.ico
-
Rose-Grabber-main/components/assets/RoseLoadingScreen.gif.gif
-
Rose-Grabber-main/components/assets/RoseLoadingScreen.mp4
-
Rose-Grabber-main/components/assets/imageres-011.ico
-
Rose-Grabber-main/components/assets/roseontop.jpg.jpg
-
Rose-Grabber-main/components/builder.bat
-
Rose-Grabber-main/components/commands/README.md
-
Rose-Grabber-main/components/injection/injection.js.js
-
Rose-Grabber-main/components/readme/$rose-b.png.jpg
-
Rose-Grabber-main/components/readme/$rose-br.png.jpg
-
Rose-Grabber-main/components/readme/$rose-wh.png.png
-
Rose-Grabber-main/components/readme/Discord_6ElGNQxTZw.png.png
-
Rose-Grabber-main/components/readme/Discord_NprIlyu0Fi.png.png
-
Rose-Grabber-main/components/readme/Discord_TGEaku8i2n.png.png
-
Rose-Grabber-main/components/readme/Discord_ZHPRdfPVY4.png.png
-
Rose-Grabber-main/components/readme/Discord_d5cUa94C1j.png.png
-
Rose-Grabber-main/components/readme/Discord_hHMxDJWplY.png.png
-
Rose-Grabber-main/components/readme/Discord_zzIPCogBKh.png.png
-
Rose-Grabber-main/components/readme/RoseBabyOnTop_bdzkkxrSuW.png.png
-
Rose-Grabber-main/components/readme/cmd_UHGKvO9f7Y.png.png
-
Rose-Grabber-main/components/readme/opera_MDZbztqx5e.png.png
-
Rose-Grabber-main/components/readme/opera_j0Pf32tJr5.png.png
-
Rose-Grabber-main/components/readme/python_D7ulIFRSE9.png.png
-
Rose-Grabber-main/components/readme/python_JDh53FMx1X.png.png
-
Rose-Grabber-main/components/readme/python_qLJQPwImIs.png.png
-
Rose-Grabber-main/components/readme/python_xAf0dVCV7y.png.png
-
Rose-Grabber-main/components/roseui/msg.txt
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/COPYING
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/LICENSE
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/NEWS
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/README
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/THANKS.txt
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx-doc.html.html .vbs
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx-doc.txt.vbs
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx.1.vbs
-
Rose-Grabber-main/components/roseui/upx-4.1.0-win64/upx.exe.exe windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 542KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 885KB - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Rose-Grabber-main/components/roseui/v8.pyw
-
Rose-Grabber-main/components/scrapedata/requirements.txt
-
Rose-Grabber-main/components/source/InjectX.py
-
Rose-Grabber-main/components/source/__webhook.py
-
Rose-Grabber-main/components/source/_file.py
-
Rose-Grabber-main/components/source/_random_string.py
-
Rose-Grabber-main/components/source/_roblox.py
-
Rose-Grabber-main/components/source/_webhook.py
-
Rose-Grabber-main/components/source/antivm.py
-
Rose-Grabber-main/components/source/browser.py
-
Rose-Grabber-main/components/source/config.py
-
Rose-Grabber-main/components/source/crypto_miner.py
-
Rose-Grabber-main/components/source/decrypter.py
-
Rose-Grabber-main/components/source/deviceinf.py
-
Rose-Grabber-main/components/source/discordc.py
-
Rose-Grabber-main/components/source/ipinf.py
-
Rose-Grabber-main/components/source/knight_rat.py
-
Rose-Grabber-main/components/source/main.py
-
Rose-Grabber-main/components/source/ransomware.py
-
Rose-Grabber-main/components/source/rose_rat.py
-
Rose-Grabber-main/components/source/startup.py
-
Rose-Grabber-main/components/source/uac_bypass.py
-
Rose-Grabber-main/components/tools/convert_color.py
-
Rose-Grabber-main/components/tools/rose_builder.pyw
-
Rose-Grabber-main/setup.cfg
-
Rose-Grabber-main/start.bat
-
Rose-Grabber-main/tox.ini