Growtopia-CID-Creator-v4-main.zip
- SHA256 21d5b46651ba9e0463aeaff71b5274e671d1818d7ca6ce2b95c92060d1a67853
Overview
overview
10Static
static
10CID Creato...v4.exe
windows7-x64
10CID Creato...v4.exe
windows10-2004-x64
10CID Creato...ry.dll
windows7-x64
1CID Creato...ry.dll
windows10-2004-x64
1CID Creato...gn.dll
windows7-x64
1CID Creato...gn.dll
windows10-2004-x64
1CID Creato...rk.dll
windows7-x64
1CID Creato...rk.dll
windows10-2004-x64
1CID Creato...rd.dll
windows7-x64
1CID Creato...rd.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
CID Creator v4/CID Creator v4.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
CID Creator v4/CID Creator v4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
CID Creator v4/Memory.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
CID Creator v4/Memory.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
CID Creator v4/MetroFramework.Design.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
CID Creator v4/MetroFramework.Design.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
CID Creator v4/MetroFramework.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
CID Creator v4/MetroFramework.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
CID Creator v4/netstandard.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
CID Creator v4/netstandard.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Growtopia-CID-Creator-v4-main.zip
- Size 745KB
- Sample240703-nsp1ca1brc
- SHA256 21d5b46651ba9e0463aeaff71b5274e671d1818d7ca6ce2b95c92060d1a67853
- MD5 8bf77e8ed082b3fda163587b57690324
- SHA1 f3f581cf201a5492b76cfd5cbc0ef43c49e31837
- SHA512 ee8ce45114705a648089a8730243e6211b758cda99635cfb22584d8e4bc56c7ce183909e4aa58c650f5c709ae4dd9c79808405e7208ed8a8147ff1b359c170f2
- SSDEEP 12288:fIlRWPpfFTnRDxC0U6/0YyQGNiSScd2HnH0GFJsZnM5vKWIj0hZLAyR7:fIlshHgl9QGUYd2HXsZnM5C7ocE7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Eternity stealer 1 IoCs
resource yara_rule static1/unpack002/CID Creator v4/CID Creator v4.exe eternity_stealer - Eternity family
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack002/CID Creator v4/CID Creator v4.exe unpack002/CID Creator v4/Memory.dll unpack002/CID Creator v4/MetroFramework.Design.dll unpack002/CID Creator v4/MetroFramework.dll unpack002/CID Creator v4/netstandard.dll
File Explorer
-
Growtopia-CID-Creator-v4-main.zip.zip 745KB
-
Growtopia-CID-Creator-v4-main/CID Creator v4.zip.zip 745KB
-
CID Creator v4/CID Creator v4.exe.exe 887KB
-
CID Creator v4/Memory.dll.dll 34KB
-
CID Creator v4/MetroFramework.Design.dll.dll 16KB
-
CID Creator v4/MetroFramework.dll.dll 345KB
-
CID Creator v4/netstandard.dll.dll 103KB
-
Growtopia-CID-Creator-v4-main/README.md1KB
Growtopia-CID-Creator-v4-main/CID Creator v4.zip
- SHA256 60771328e43d6477b488aaec165e86dbf714a55c5e09bf62bbf83a4c6109c43c
- MD5 8f34e7dc52c2f9956f186a9370f634d8
- SHA1 969947a7a6da8d8c1f139ef75d6db38f5e105e8d
- SHA512 3d266813c6c46beda61a1ca8a0b8c145d519f27147a21838f59b975756132426f0174914d2c025727b1b17b07bc8261ef2f0caf521aab801cdf1e116e55ec67c
- SSDEEP 12288:hTQPehFbnRpTC0Ju70YmQ6XoISidNClNN6GFmWKsZDoNo1EZkq2+VHPm9:hUmDMiuQQ6YEdIli5sZsNo8kqDVHk
- MD5 SHA1 SHA512 SSDEEP
CID Creator v4/CID Creator v4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1009114a68417ee36692f95cbada8e43800093626e30c30eef0a64f3bbcab71f
- MD5 597144fc2c2ae9120504a43acd8ce132
- SHA1 2ef994d2ef44f7c7e436702ef2887980c6d0b3a0
- SHA512 8ed51d26e8790f19a552e8bc63de9bc17182d0262faf3727aac1ac4259709c4ca0ed693dd39b53c450d4aaefc3ee4cc82e69c77de958225c7cf5c51080701187
- SSDEEP 12288:1TEYAsROAsrt/uxduo1jB0Y96qkK2QKy9hes7fKDF/c+zZeaySBcwkHv:1wT7rC6qGQKyCs7fKDC+QXKRkHv
- MD5 SHA1 SHA512 SSDEEP
-
Detects Eternity stealer
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
280302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.eter0
Size
443KB
Virtual Size
443KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.eter1
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CID Creator v4/Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7534bbe4f084f9377e57940b98af5c817340b41c436e7f89b9bfac654c9bae50
- MD5 c548871fcf701fe39e1c429c210e2b2c
- SHA1 fcc4c8f4c9050fb3e00792a04729a51f5866291c
- SHA512 4f8d48991707ec07b9485c7f8ec421b4cf6835f39a7e644edd8d7bb222627a085fd4be49fa061a1214e465c361b683685718b50aebfd7dca417b161788ec4178
- SSDEEP 768:CNcw1ADOkzoQzGYZZq1dE4mJDss8h9oGPLP8:CNcw1AD92YrMdE7JD6LP8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Jake\Documents\GitHub\memory.dll\Memory\obj\Debug\Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CID Creator v4/MetroFramework.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CID Creator v4/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CID Creator v4/netstandard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ddf8ecc841a4691864e52a15b5c01f9014380dbc3a9fe66c633d6f156b490d63
- MD5 e631c3ae18c51e1e3a67ca435109f203
- SHA1 6bdb9ea4d9ad57491e2a9f0b2f0b7d7ef1a95a9e
- SHA512 1360845461d25709a68e1c101d6b3a3600813bffecf591cb6286c7a5eb36ee9ca7db9d8d39952f037ca929e5652c036833ba921aafe099589207f1ab21625607
- SSDEEP 1536:N2Ec05j4eAH64rh5fSt5T9nFcI94OlaM1WGFwm+:8lK4eA7mDmOgM9K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
87530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Growtopia-CID-Creator-v4-main/README.md
- SHA256 a1d7b1b6f7df89a54fafbef1033b4a986b77065821e1da9e68d38f87f775706a
- MD5 c0a18a732764a43acfd56aeb8f13a332
- SHA1 feb5d2389877ef3a66f59d9f2e199ca1a0c4ee1b
- SHA512 6186e504faa18e689c80c91a469a88f42dd9b8fa3139e74e472f2e3226b3e19f08dda3889d73feb1a4eaf8454f9353685c83d347443621745fbf36bba392c9c3
- MD5 SHA1 SHA512