grandoreiro | 06cd078e35569a5c5fa9dd53e5652b9b[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

06cd078e35569a5c5fa9dd53e5652b9b.bin
Size

18.2MB
MD5

3067f4b20632aa5fb3de80e6eaed8bc3
SHA1

f246d12bbae083511f60729b9797acbb7eacf4f7
SHA256

8d1f480434ccdd189f50ef219113d5b030f38b249eb612b80e3809604520c90c
SHA512

f88eb829960e79268fed460474ca944698cd1e068f1950d463d314b2b9c37ca9ef60442af3932dcddc6e411f8fb52b623e2422783dd4aeb0cd999b974784ca3f
SSDEEP

393216:DW4NAE7BusJB3LZVVDCZM3s+X5/6/G0PmSr4LGrp9jpyzoJP2ltXgoB:DjNvbteG3s+X9mG0v2C/JeHgoB

Score

10^/10

grandoreiro

Malware Config

Signatures

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
static1/unpack001/de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.exe	family_grandoreiro_v1

Grandoreiro family
grandoreiro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.exe

Files

06cd078e35569a5c5fa9dd53e5652b9b.bin
.zip

Password: infected
de87ce756e50ab7af5074e91a856029d87656fdf7fe095af5661038da9de8c21.exe
.exe windows:5 windows x86 arch:x86

Password: infected

e279aa025f252735725ead1a0702473e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersion
TlsSetValue
GetVersionExA
GetVersion
Sleep
MulDiv
OpenThread
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetKeyboardType
CreateWindowExA
CharUpperBuffW

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
CreateErrorInfo

mpr

WNetOpenEnumA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID
CreateBindCtx

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA
DEVICECAPABILITIES

shell32

ShellExecuteW

urlmon

URLDownloadToFileA

comdlg32

PrintDlgA

winmm

timeGetTime

wsock32

__WSAFDIsSet

ntdll

RtlNtStatusToDosError

magnification

MagSetImageScalingCallback

Exports

Exports

adler32
adler32_combine
adler32_combine64
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
fill_fopen_filefunc
get_crc_table
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpenCurrentFile
unzOpenW
unzReadCurrentFile
zError
zipClose
zipCloseFileInZip
zipOpen
zipOpen2
zipOpenNewFileInZip
zipWriteInFileInZip
zlibCompileFlags
zlibVersion

Sections

CODE
Size: 16.4MB - Virtual size: 16.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1M
Size: 11.7MB - Virtual size: 11.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.&N_
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.595
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e279aa025f252735725ead1a0702473e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

mpr

version

gdi32

ole32

comctl32

winspool.drv

shell32

urlmon

comdlg32

winmm

wsock32

ntdll

magnification

Exports

Exports

Sections

CODE Size: 16.4MB - Virtual size: 16.4MB

DATA Size: 72KB - Virtual size: 72KB

BSS Size: 84KB - Virtual size: 84KB

.idata Size: 16KB - Virtual size: 16KB

.edata Size: 4KB - Virtual size: 4KB

.t1M Size: 11.7MB - Virtual size: 11.7MB

.&N_ Size: 4KB - Virtual size: 4KB

.595 Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 212KB - Virtual size: 212KB

.rsrc Size: 4KB - Virtual size: 4KB

CODE
Size: 16.4MB - Virtual size: 16.4MB

DATA
Size: 72KB - Virtual size: 72KB

BSS
Size: 84KB - Virtual size: 84KB

.idata
Size: 16KB - Virtual size: 16KB

.edata
Size: 4KB - Virtual size: 4KB

.t1M
Size: 11.7MB - Virtual size: 11.7MB

.&N_
Size: 4KB - Virtual size: 4KB

.595
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 212KB - Virtual size: 212KB

.rsrc
Size: 4KB - Virtual size: 4KB