Overview

overview

9

Static

static

7

Growpai_5....h1.zip

windows10-ltsc 2021-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Growpai_5.02_12262024_patch1.zip

  • Size

    14.5MB

  • Sample

    241226-2stv7atpgr

  • MD5

    a2d60bb6d5b4349f3d41c5eb9d32b583

  • SHA1

    cd32d3cf02efa117e6e0b744ae9dc2cd0b14cfe5

  • SHA256

    93138cac9a20283698cc994b32d6f25c87d18dc60daebe498ba05a241fb0d95b

  • SHA512

    ea406b89c47c523c1940210606c8678b7d7369883cd826f042080fb41dac4573b46d1aa5ac03bafbadbb92f8dc787cc6273aac6c6422c6148337df6fa33decc8

  • SSDEEP

    393216:JakLIKvHBiaD6pgWZHrUzxRb/J05miy1CpBMM2:wkUWHBi06jZLaTJ06SBs

Score
9/10
steamdiscoveryevasionphishingthemidatrojan

Malware Config

Targets

    • Target

      Growpai_5.02_12262024_patch1.zip

    • Size

      14.5MB

    • MD5

      a2d60bb6d5b4349f3d41c5eb9d32b583

    • SHA1

      cd32d3cf02efa117e6e0b744ae9dc2cd0b14cfe5

    • SHA256

      93138cac9a20283698cc994b32d6f25c87d18dc60daebe498ba05a241fb0d95b

    • SHA512

      ea406b89c47c523c1940210606c8678b7d7369883cd826f042080fb41dac4573b46d1aa5ac03bafbadbb92f8dc787cc6273aac6c6422c6148337df6fa33decc8

    • SSDEEP

      393216:JakLIKvHBiaD6pgWZHrUzxRb/J05miy1CpBMM2:wkUWHBi06jZLaTJ06SBs

    Score
    9/10
    steamdiscoveryevasionphishingthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Detected potential entity reuse from brand STEAM.

      phishingsteam

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks