Overview
overview
10Static
static
10decompiler...or.exe
windows7-x64
7decompiler...or.exe
windows10-2004-x64
7decompiler...obf.py
windows7-x64
3decompiler...obf.py
windows10-2004-x64
3decompiler...ben.py
windows7-x64
3decompiler...ben.py
windows10-2004-x64
3decompiler...ank.py
windows7-x64
3decompiler...ank.py
windows10-2004-x64
3decompiler...ean.py
windows7-x64
3decompiler...ean.py
windows10-2004-x64
3decompiler...una.py
windows7-x64
3decompiler...una.py
windows10-2004-x64
3decompiler...obf.py
windows7-x64
3decompiler...obf.py
windows10-2004-x64
3decompiler...her.py
windows7-x64
3decompiler...her.py
windows10-2004-x64
3decompiler...er.jar
windows7-x64
1decompiler...er.jar
windows10-2004-x64
7decompiler...pycdas
ubuntu-22.04-amd64
1decompiler...as.exe
windows7-x64
1decompiler...as.exe
windows10-2004-x64
1decompiler.../pycdc
ubuntu-24.04-amd64
1decompiler...dc.exe
windows7-x64
1decompiler...dc.exe
windows10-2004-x64
1decompiler...in/upx
ubuntu-24.04-amd64
1decompiler...px.exe
windows7-x64
7decompiler...px.exe
windows10-2004-x64
7decompiler...fig.py
windows7-x64
3decompiler...fig.py
windows10-2004-x64
3decompiler...ile.py
windows7-x64
3decompiler...ile.py
windows10-2004-x64
3decompiler...ion.py
windows7-x64
3Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 13:54
Behavioral task
behavioral1
Sample
decompiler for malware/GeFrost Exucutor.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
decompiler for malware/GeFrost Exucutor.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
decompiler for malware/Grabbers-Deobfuscator-main/deobf.py
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
decompiler for malware/Grabbers-Deobfuscator-main/deobf.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/ben.py
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/ben.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/blank.py
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/blank.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/empyrean.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/empyrean.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/luna.py
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/luna.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/notobf.py
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/notobf.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/other.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
decompiler for malware/Grabbers-Deobfuscator-main/methods/other.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/fernflower.jar
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/fernflower.jar
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdas
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral20
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdas.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdas.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdc
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral23
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdc.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/pycdc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/upx
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral26
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/upx.exe
Resource
win7-20240508-en
Behavioral task
behavioral27
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/upx.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral28
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/config.py
Resource
win7-20240220-en
Behavioral task
behavioral29
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/config.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/decompile.py
Resource
win7-20231129-en
Behavioral task
behavioral31
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/decompile.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral32
Sample
decompiler for malware/Grabbers-Deobfuscator-main/utils/deobfuscation.py
Resource
win7-20240221-en
General
-
Target
decompiler for malware/GeFrost Exucutor.exe
-
Size
16.2MB
-
MD5
01c1a2840a79619a9dfbe14875711265
-
SHA1
b3a45f44d144687261697e2e598d438f002fab0b
-
SHA256
43779008ecd32cec3849fa89d38f02a7c49d3b0eac9bef0d8627277fc2c43a43
-
SHA512
978ce7897ecaaf53ebc39fcb3c02b555d8c9aea64b1bf31eba83208dd57b06a8bcccbe6cc8dea460f514af3d2f9e4e938c08adb50071951f0014b1a8d538c3a5
-
SSDEEP
393216:hEkcqY4gP8AxYDX1+TtIiFvY9Z8D8Ccl6lnbE0PKksbuK+:hkD4bX71QtI6a8DZcIlbskBK+
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
GeFrost Exucutor.exepid process 2424 GeFrost Exucutor.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
GeFrost Exucutor.exedescription pid process target process PID 2340 wrote to memory of 2424 2340 GeFrost Exucutor.exe GeFrost Exucutor.exe PID 2340 wrote to memory of 2424 2340 GeFrost Exucutor.exe GeFrost Exucutor.exe PID 2340 wrote to memory of 2424 2340 GeFrost Exucutor.exe GeFrost Exucutor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\decompiler for malware\GeFrost Exucutor.exe"C:\Users\Admin\AppData\Local\Temp\decompiler for malware\GeFrost Exucutor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\decompiler for malware\GeFrost Exucutor.exe"C:\Users\Admin\AppData\Local\Temp\decompiler for malware\GeFrost Exucutor.exe"2⤵
- Loads dropped DLL
PID:2424
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI23402\python312.dllFilesize
6.6MB
MD53c388ce47c0d9117d2a50b3fa5ac981d
SHA1038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35