growtopia | Sahyui1337[.]exe | Triage

Sharing

General

Target

Sahyui1337.exe
Size

317KB
MD5

b30d6082fdf73d9819e370aa136bbfa6
SHA1

6ea3f9e4cdf851aaea6d7f4e3cd84ecfadd78446
SHA256

fb8de051b637f07894db5e68b260536834a267fd92bf55b3d317e4dc05f299f0
SHA512

f7f48615f9ee472200bec58ce1ee328e4de7ec32a6049664f7f5b30ddf642f93b70c20c6fd33777ef818567f375723bbb13dcf70ddf0f544badd7f07b3349d6f
SSDEEP

6144:IBcU6MDdbBCydeWk+Oxk3K7hL5Nuy8R9M5aTxSVZEDQd:IBzzAk3K7hL3aNSVQQd

Score

10^/10

growtopia

Malware Config

Extracted

Family

growtopia

C2

https://discord.com/api/webhooks/1213276088067956746/zJW67eYDWSXdbZ0gcW2u1ph9Sy4d5Gty57RjKvf-OGTMj-ubZMU_ZFvxQE_Yec_aCK5b

Signatures

Growtopia family
growtopia

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sahyui1337.exe

Files

Sahyui1337.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\notfishvr\Downloads\GodStealer-main\GodStealer-main\GodStealer\obj\Debug\Sahyui1337.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ