Extracted

• • Target

    69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04

  • Size

    5.5MB

  • MD5

    6c1ef92690b2d4672136ac59dcdd3abf

  • SHA1

    d0f21d7c68c0590f735b3bfa09517a231592de6a

  • SHA256

    69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04

  • SHA512

    ec914db73f6e2a331b6877f7c8d7093273347d1b0ce0e12484d4e2294f98d742ae265233c438589404c5fdd33a6450d13ae921e3a90f69609c0cbb5bcb3c585d

  • SSDEEP

    98304:vyghDiIufzZIKj5Ahc3x8x/3a1UVG+5T8wNyxZnkkYOWt:vJhZuf+W1xGSUVG+x8wQZXYh

  Score

  10^/10

  grandoreirolatentbotbankerdiscoverypersistencetrojan

  • Detects Grandoreiro payload

  • Grandoreiro

    Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.

    trojanbankergrandoreiro

  • Grandoreiro family

    grandoreiro

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2