Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
02-03-2024 00:18
General
-
Target
Sahyui1337.exe
-
Size
316KB
-
MD5
2693065c7466d53bc86bc26ab8d657ea
-
SHA1
8ec18593214537e019cedc37267156871c57cd2c
-
SHA256
3a506705c6e005e1a74b9449af0e7474b3a8602442e84cd6ece7f1fbc99a3929
-
SHA512
f470bfe4cdca82de7d453d4dbeaed8de46cf1e82a9c1a9fbd7d4180158500f97311ca631e4a6c43416d999a6c9a12487c8b31a46956a1e360a8f265c173f6401
-
SSDEEP
6144:0syU6MDdbBCydeWh53MCL7LLVmBivzU7nx5VZ2Fvd:0spP3MCL7LTG5V0vd
Score
10/10
Malware Config
Extracted
Family
growtopia
C2
https://discord.com/api/webhooks/1213276088067956746/zJW67eYDWSXdbZ0gcW2u1ph9Sy4d5Gty57RjKvf-OGTMj-ubZMU_ZFvxQE_Yec_aCK5b
Signatures
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB