grabber_rs[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

grabber_rs.exe
Size

4.8MB
MD5

dd5915644fd9ce65729045291eaf5a8a
SHA1

b34828c3cf533b6add5f53ef2a6595cd06b6cf9a
SHA256

175d32f26b8061e9151300809ed65be9024853ad767c557e41116d2a770b14c7
SHA512

855f9687806d77a763fe31a15117c2ceb5b9915db402e54a854cff7e7aa273976e6bd185a3e56230bfc59829f2b9885dd4b67c36be691fa015469d6c817fd14c
SSDEEP

98304:OuTPeWKC0LSV4HhLLMZB2KNmF9BmTngaS:iLWV4hf9Ab

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
grabber_rs.exe

Files

grabber_rs.exe
.exe windows:6 windows x64 arch:x64

ec46e49adbffef6ff94f2b1e91a4786c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

grabber_rs.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

crypt32

CertFreeCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertGetCertificateChain

iphlpapi

GetAdaptersAddresses

kernel32

TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
HeapSize
SetUnhandledExceptionFilter
HeapFree
FindClose
CloseHandle
FreeLibrary
SwitchToThread
SetCurrentDirectoryW
GetLastError
LoadLibraryA
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
HeapReAlloc
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
CreateIoCompletionPort
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetSystemInfo
PostQueuedCompletionStatus
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
FindFirstFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
DeleteFileW
SetHandleInformation
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
UnhandledExceptionFilter

ntdll

NtReadFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCancelIoFileEx
NtCreateFile

ws2_32

shutdown
WSASocketW
ioctlsocket
setsockopt
bind
connect
getsockopt
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
recv
send
WSASend
closesocket
getsockname
WSAGetLastError
getpeername
WSAIoctl

secur32

FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW
DecryptMessage
ApplyControlToken
AcquireCredentialsHandleA

vcruntime140

memcpy
memmove
memcmp
memset
__CxxFrameHandler3
strrchr
__current_exception_context
__current_exception
__C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen
strcspn
strncmp
strcmp

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr
log

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
realloc
_msize
free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_crt_atexit
terminate
_c_exit
_cexit
__p___argv
__p___argc
exit
_beginthreadex
_endthreadex
_register_onexit_function
_initterm_e
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec46e49adbffef6ff94f2b1e91a4786c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

crypt32

iphlpapi

kernel32

ntdll

ws2_32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 21KB - Virtual size: 24KB

.pdata Size: 88KB - Virtual size: 87KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 21KB - Virtual size: 24KB

.pdata
Size: 88KB - Virtual size: 87KB

.reloc
Size: 26KB - Virtual size: 25KB