grandoreiro | de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.dll.exe
Size 30.7MB
Sample241108-vcs6dswbqq
SHA256 de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21
MD5 06cd078e35569a5c5fa9dd53e5652b9b
SHA1 bd514c85cd95b7c41b8edd2177fd7ce02c7a793d
SHA512 c4f1fb90aa03f5f06705183eebc20e12ed9ac0c4a90c9d66d3ccb89d67940bc9f9f9fbe716a25dff626830d39900d9bda5c3fcb169e95ce5dccf005ae300eb7e
SSDEEP 393216:5NVQVZ65EyvmSfbHcruXKNhhciGve1gFR4+O:l4LDSjHKNAiYj/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

grandoreiro

Malware Config

Signatures

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
sample	family_grandoreiro_v1

Grandoreiro family
grandoreiro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.dll.exe

File Explorer

de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.dll.exe

.exe 30.7MB

de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.dll.exe

IMPHASH e279aa025f252735725ead1a0702473e
SHA256 de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21
MD5 06cd078e35569a5c5fa9dd53e5652b9b
SHA1 bd514c85cd95b7c41b8edd2177fd7ce02c7a793d
SHA512 c4f1fb90aa03f5f06705183eebc20e12ed9ac0c4a90c9d66d3ccb89d67940bc9f9f9fbe716a25dff626830d39900d9bda5c3fcb169e95ce5dccf005ae300eb7e
SSDEEP 393216:5NVQVZ65EyvmSfbHcruXKNhhciGve1gFR4+O:l4LDSjHKNAiYj/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Grandoreiro payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17222632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

16.4MB

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.t1M

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.&N_

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.595

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.dll.exe

kernel32

user32

advapi32

oleaut32

mpr

version

gdi32

ole32

comctl32

winspool.drv

shell32

urlmon

comdlg32

winmm

wsock32

ntdll

magnification

generic