grapeloader | d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164[.]dll

General

Target
d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164.dll
Size 178KB
Sample250910-tr73es1wbs
SHA256 d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164
MD5 e025fa8354968f298af3f6ef2f22d7d3
SHA1 b4221c83a3fffe7bc358dfc613c3e58fcc522a23
SHA512 fe94d1ceac87b4907917683384dc0cc88734edca6236e21d86d3fe5018671ed6cb86b249d5a65015dc8119c328a6140dfa52609ded07de15e3e40bd973d4fc9d
SSDEEP 3072:tIGcUg4CHNf5iI1azsrj5KhwQR79hqpJ0sOkg7tyCFYUX:Qlxza4rj5Po79hYJ2pnFYUX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader apt apt29 grapeloader

Malware Config

Signatures

Detects GrapeLoader 1 IoCs

loader apt apt29

resource	yara_rule
sample	family_grapeloader

Grapeloader family
grapeloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164.dll

File Explorer

d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164.dll

.dll 178KB

d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164.dll

IMPHASH b193916914acf4f5d8cb2925a95f8739
SHA256 d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164
MD5 e025fa8354968f298af3f6ef2f22d7d3
SHA1 b4221c83a3fffe7bc358dfc613c3e58fcc522a23
SHA512 fe94d1ceac87b4907917683384dc0cc88734edca6236e21d86d3fe5018671ed6cb86b249d5a65015dc8119c328a6140dfa52609ded07de15e3e40bd973d4fc9d
SSDEEP 3072:tIGcUg4CHNf5iI1azsrj5KhwQR79hqpJ0sOkg7tyCFYUX:Qlxza4rj5Po79hYJ2pnFYUX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects GrapeLoader

loader apt apt29
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

64480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WriteConsoleW RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Sharing