growtopia | e4c2460165de097c187d1a646cfc513d32a9130a0e3fe40a359f82b54987bb23 | Triage

Submit
Reports

Overview

overview

Static

static

7

f51b489073...18.exe

windows7-x64

f51b489073...18.exe

windows10-2004-x64

Sharing

General

Target

f51b489073e0a0e9fff1a9d8f0e09185_JaffaCakes118
Size

5.4MB
Sample

240417-fwrdksga8v
MD5

f51b489073e0a0e9fff1a9d8f0e09185
SHA1

c8a2cf999334870c51ead8e366ce51ee916b6e3f
SHA256

e4c2460165de097c187d1a646cfc513d32a9130a0e3fe40a359f82b54987bb23
SHA512

c724d3245868a6a6a90ad0f169ba39857f192809ac0e0b7919ebd53ca7669080703571fd235e129130ddc157286534905dcb6ca7e951e7d8ce3347184eb89484
SSDEEP

98304:7aK90IOLFoFMy2Wt6E8jtpOEv9NdHkyLhiCyIgFfffHyBUMUbv5wOJERH:X9POJa2WD69Nay8Mg1ffS2/K4ER

Score

10^/10

growtopia stealer vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f51b489073e0a0e9fff1a9d8f0e09185_JaffaCakes118.exe

Resource

win7-20240221-en

growtopia stealer vmprotect

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

f51b489073e0a0e9fff1a9d8f0e09185_JaffaCakes118.exe

Resource

win10v2004-20240412-en

growtopia stealer vmprotect

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  f51b489073e0a0e9fff1a9d8f0e09185_JaffaCakes118
- Size
  
  5.4MB
- MD5
  
  f51b489073e0a0e9fff1a9d8f0e09185
- SHA1
  
  c8a2cf999334870c51ead8e366ce51ee916b6e3f
- SHA256
  
  e4c2460165de097c187d1a646cfc513d32a9130a0e3fe40a359f82b54987bb23
- SHA512
  
  c724d3245868a6a6a90ad0f169ba39857f192809ac0e0b7919ebd53ca7669080703571fd235e129130ddc157286534905dcb6ca7e951e7d8ce3347184eb89484
- SSDEEP
  
  98304:7aK90IOLFoFMy2Wt6E8jtpOEv9NdHkyLhiCyIgFfffHyBUMUbv5wOJERH:X9POJa2WD69Nay8Mg1ffS2/K4ER
Score

10^/10

growtopia stealer vmprotect
- Growtopia
  Growtopa is an opensource modular stealer written in C#.
  stealer growtopia
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

growtopiastealervmprotect

behavioral2

growtopiastealervmprotect

© 2018-2024

Terms | Privacy