GTX Grabber.zip
- SHA256 0079d2cfb6a68deb9880876977a5d2a24ca7c80ce52ee2cb954a3e26d166f85b
Behavioral task
behavioral1
Sample
GTX Grabber/GTX Grabber.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
GTX Grabber/GTX Grabber.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target GTX Grabber.zip
- Size 13.9MB
- Sample260506-pygrlabs2v
- SHA256 0079d2cfb6a68deb9880876977a5d2a24ca7c80ce52ee2cb954a3e26d166f85b
- MD5 dbe14355237450839123fcea96e583bf
- SHA1 e1787f32bf6e3281d5d1b2d3cdbd7e2c5ca2b295
- SHA512 49b2f51e8d0f0155a4eb4b38909fd2debdc318706329d9a8de0a34f4b5529e57c108721c2fa7e28432c9fdba9ff7354e7ed893ed0ce9f73a13965e46b06de461
- SSDEEP 393216:Toif/+ihR7aPeb0ZREPWyv4Ei0+56g/FHJqbjwDi0CIaW:jX+yR7aWIZSWrx0y6g7QxtIaW
- TLSH T179E633CFB1A4CDB0D3C6C534173506A7B13ED6476324693439AAB67721AD2030A7B9AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- Family: crealstealer
An infostealer written in Python and packaged with PyInstaller.
- A stealer written in Python and packaged with Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/GTX Grabber/GTX Grabber Builder/Components/loader.py blankgrabber_exe static1/unpack001/GTX Grabber/GTX Grabber Builder/Components/process.py blankgrabber_exe - An infostealer written in Python and packaged with PyInstaller. 1 IoCs
resource yara_rule static1/unpack003/Creal.pyc crealstealer - Detects BlankGrabber stealer in memory 1 IoCs
resource yara_rule static1/unpack001/GTX Grabber/GTX Grabber Builder/Components/stub.py blankgrabber_dmp - Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx - Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/GTX Grabber/GTX Grabber Builder/Components/rar.exe -
resource yara_rule static1/unpack001/GTX Grabber/GTX Grabber Builder/Components/upx.exe upx - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/GTX Grabber/GTX Grabber.exe pyinstaller - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/GTX Grabber/GTX Grabber Builder/Components/upx.exe unpack002/out.upx unpack001/GTX Grabber/GTX Grabber.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/GTX Grabber/GTX Grabber Builder/Components/rar.exe
File Explorer
-
GTX Grabber.zip.zip 13.9MB
-
GTX Grabber/GTX Grabber Builder/Builder.bat1KB
-
GTX Grabber/GTX Grabber Builder/Components/BlankOBF.py5KB
-
GTX Grabber/GTX Grabber Builder/Components/cert9KB
-
GTX Grabber/GTX Grabber Builder/Components/config.json976B
-
GTX Grabber/GTX Grabber Builder/Components/loader.py634B
-
GTX Grabber/GTX Grabber Builder/Components/postprocess.py2KB
-
GTX Grabber/GTX Grabber Builder/Components/process.py8KB
-
GTX Grabber/GTX Grabber Builder/Components/rar.exe.exe 615KB
-
GTX Grabber/GTX Grabber Builder/Components/rarreg.key456B
-
GTX Grabber/GTX Grabber Builder/Components/requirements.txt40B
-
GTX Grabber/GTX Grabber Builder/Components/run.bat.bat 1KB
-
GTX Grabber/GTX Grabber Builder/Components/sigthief.py.py .sh 10KB
-
GTX Grabber/GTX Grabber Builder/Components/stub.py99KB
-
GTX Grabber/GTX Grabber Builder/Components/upx.exe.exe 525KB
-
out.upx.exe 2.0MB
-
GTX Grabber/GTX Grabber Builder/Components/version.txt1KB
-
GTX Grabber/GTX Grabber Builder/Extras/hash49B
-
GTX Grabber/GTX Grabber Builder/Extras/icon.ico4KB
-
GTX Grabber/GTX Grabber Builder/Extras/unblock_sites.py1KB
-
GTX Grabber/GTX Grabber Builder/READme.txt170B
-
GTX Grabber/GTX Grabber Builder/config.json57B
-
GTX Grabber/GTX Grabber Builder/gui.py38KB
-
GTX Grabber/GTX Grabber.exe.exe 13.2MB
-
Creal.pyc169KB
-
GTX Grabber/LICENSE1KB
-
GTX Grabber/README.md7KB
-
GTX Grabber/changelog.md1KB
GTX Grabber/GTX Grabber Builder/Builder.bat
- SHA256 79e1377ac17e6aece067d4cf6a202d8baf43a9906cea353de7188c43b20500c8
- MD5 69f3538d09da509b93329b22fd59a956
- SHA1 d74ccc96102895e111712beedabcdc725fb23360
- SHA512 a5e2fdeb2d185acda43e6a0d964966fc5246d2fe598d094e0b59bd757c42170d3e4125cf7da736080a95141b453d12a53af295eb53bd64e431285e8213da9b07
- TLSH T13D118E252015B87E7720D70781D792A2B6FA80D353726599B0FB42DF0F5655478BB602
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Components/BlankOBF.py
- SHA256 73bd45bbbf96aa84a2abf5eef93513126bd3adbbbb5ebd5272776643d99c1fb8
- MD5 b3d2f59792b99d98107717d6b7100cf3
- SHA1 5cf1f176236fb12fd665301a64be7d883ca125c8
- SHA512 1791b325ea86c56d35ff9c9216685dd7b3d0b0d01538de5cb6310cb64750daadbeccddbe51fc985bb22a8d8e67ab1a180708e7b97441e0daa2c0b1c14e918ed8
- SSDEEP 96:Fr54cd62hK9FFZ48PuCQYBX5oQL6oUMOQcL:FP6Us4B8JoQLBsQcL
- TLSH T13EC131728C622CF16F17CA0889AAC4274A7E9E6F520C5560F8FD63C55F24572C4FADE8
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/GTX Grabber Builder/Components/cert
- SHA256 090b03e1ff82d53fb90c3776be756465d6bc4dc04b164348eeab703a72bb2243
- MD5 b769e370f66299bca7f86932bc24925f
- SHA1 b4d882856a109412ed64c2449f51eab4697c844f
- SHA512 a8e6b45c9623739b170aff0ae9109ceaa02ae1f1cd2a5f2ceca78c9b3446de010cea66afe2128795f441c91105fba5eaf4ba91991847f3874564d020a087ddeb
- SSDEEP 192:QpPIKfhig1R7JNfVZCg2tDKZpZfH0JOqsmVgz28WhBqA/v:QpwK3PVZAD28JN77hhd3
- TLSH T150123B9B1D3164539F87DD5AB1C5EB7B4C70A7E4AEA158C70078D1868F8ABD31B1802F
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/GTX Grabber Builder/Components/config.json
- SHA256 28eb749c0057fa28835c64032e1bee33f42494168dc4d21f93383020eccc5a82
- MD5 17c98daace9d0baf81f6b9856c719c36
- SHA1 8797f3c08ee01ebd3156d273a751a32cd8149afb
- SHA512 17dd9ec30682b7dbed78de8fc09e9be578ccf39d2613e8752eb82a7bf2af3b3600c94ea89114eb94473b009628ed138ecaee2ad053119e4c493492d2321290c9
- TLSH T1E9113C68C6284CBE9C60459848ED7186AD634F430E17342D719C8EDC1F1EB2FA67BAC6
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Components/loader.py
- SHA256 e7dbfe873c719006f28e6526ef54215d7b7598bce5566734c552dab9f1f487e6
- MD5 ca35548638710a32f6d4bc1a61a103c5
- SHA1 2703967c4376cc2e0ca20191eff97b85989d8310
- SHA512 d1c0839326662b240dfa4bcea7284d261be46e9bb8b03f073e0328e361321f9cdfa740abd4541b2cdc21c806bcd901d3bc3cc36b9f7e0ee6191d189df0533061
- TLSH T157F0ACEAAC7248C486CFC2D57DB0E400CD691D0B8B00B720798D3AC5E740530D6F3090
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
GTX Grabber/GTX Grabber Builder/Components/postprocess.py
- SHA256 72eefc2defd861c48721f235717a0f8de430ea8f2bc290b429cfbdc906ba539c
- MD5 bbed9f3d87c4927b2b2bc16a6ec4da51
- SHA1 c3bceb8a6fb5207abc75039e5a66afbf8324cd8f
- SHA512 352cd87d379e0a338d44f3933b6b135a36ebe83607157dfe28330ec2c03c6b2bcbbb2d43b1a06487675eea662c76084b3f9777f5b8d0c9132d50869318fc3c78
- TLSH T13C51FB04E8141954B7D2138ACC528EA01375F957A782182836ECA5C02F9983BA9FCFFC
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Components/process.py
- SHA256 72f2b7cbcc38b79ce96d12e6fdd9a45874728a1abd49eed00438069ba8006f21
- MD5 8cc1b499d73f3fc2140a5b0c97afd6f2
- SHA1 4e60e01f11ff8fec425c74679146e13713b18931
- SHA512 ac86a61d68bdac9b019d3c8a3f6102378b3e4f23be8398e6f0d79586dd29c0d104dc66e0cba267f88fb1b1d5241b74f51c073f2395f44d8f4ca34975b7534903
- SSDEEP 192:Eew1auOoI8I+IQI2Iz2Iym+IyIQICI0IiIgIcI6ISI+ISIKG2I0U0F+05dkIMN06:f4iE9pV3522EQTq1o4mE
- TLSH T19B02406550341C6AC3C6B2B4B98785A6733CBA47E40484703E6CB3EC5F36978EBE59C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
A stealer written in Python and packaged with Pyinstaller
GTX Grabber/GTX Grabber Builder/Components/rar.exe
- IMPHASH 9a33888e10929c185d02249d2b55c15a
- SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
- MD5 9c223575ae5b9544bc3d69ac6364f75e
- SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
- SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
- SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
- TLSH T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9c:66:96:14:0c:f3:61:be:84:1b:0f:4b:ea:3c:ad:de:9c:7d:83:fc:e4:45:63:45:74:6c:06:37:d3:d6:f1:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
Chains
Jun 25, 2020
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
1d:57:cb:52:be:34:8e:9b:f0:e9:6c:f8:e2:d5:9e:a4:8b:73:fc:b8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
Chains
Jun 25, 2020
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE
Serial Number
76:25:a5:9e:a4:0a:7e:7b:91:3f:91:07:23:32:8e:26
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Jun 4, 2020
Timespan
Jun 4, 2020 - Jun 4, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
2
Major OS version
5
Entry point
373376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb
kernel32
GetCurrentProcess
DeviceIoControl
FindClose
SetFileTime
CloseHandle
BackupRead
BackupSeek
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
FindFirstFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetFileTime
GetCurrentProcessId
GetDriveTypeW
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
ExpandEnvironmentStringsW
FindNextFileW
GetVersionExW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
SetErrorMode
FreeLibrary
LoadLibraryW
LoadLibraryExW
CompareStringA
GetCurrentThread
SetThreadPriority
SetThreadExecutionState
SetConsoleCtrlHandler
GetSystemDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
SetFilePointerEx
GetProcessHeap
HeapSize
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FormatMessageW
Sleep
GetLastError
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteFile
GetStdHandle
GetFileType
GetCommandLineW
GetModuleHandleW
GetProcAddress
GetFileInformationByHandle
CreateEventW
SetLastError
SetStdHandle
GetConsoleCP
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameA
GetCommandLineA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
user32
CharLowerW
CharUpperW
MessageBeep
ExitWindowsEx
LoadStringW
OemToCharBuffW
CharToOemBuffA
OemToCharBuffA
OemToCharA
CharToOemA
CharToOemBuffW
advapi32
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
GetSecurityDescriptorLength
AdjustTokenPrivileges
OpenProcessToken
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
CheckTokenMembership
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHFileOperationW
powrprof
SetSuspendState
Name
.text
Size
443KB
Virtual Size
442KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=241, version=40116,
count=131, id=243, version=40116,
count=13, id=242, version=40116,
count=2, id=199, version=41118,
count=8, id=259, version=24123,
count=42, id=261, version=24123,
count=21, id=260, version=24123,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=177, id=1, productName=Unmarked objects,
count=72, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
GTX Grabber/GTX Grabber Builder/Components/rarreg.key
- SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
- MD5 4531984cad7dacf24c086830068c4abe
- SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
- SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
- TLSH T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Components/requirements.txt
- SHA256 c835fa03bbf8b1fea4dfea6001146028562a6716f42e3a8aa33e5a22d130350d
- MD5 0717875d7e142fac144ac1e71d4ac6a0
- SHA1 a2b84254a7234831d5b50b5542d7c0e440b654af
- SHA512 6c976e3f4a047895173b4165ca88449536abcc6b95e4889b528290420340500e8f4d1f0cee38ec65ec1e2a8d93e8fdbe88981c077b5357c6bd0e91da8b3c1677
- MD5 SHA1 SHA512
GTX Grabber/GTX Grabber Builder/Components/run.bat
- SHA256 ceade703cb46e78226dc0331ea37f3ed9f681b5969b56ddd15ca5a39e8c067d3
- MD5 5beaf38a2e57c2813f6b19b3fb08aca3
- SHA1 424b0ae28d3ea1e067e8c29d45f1f84040eaa7ec
- SHA512 7265b1a73f2d4841b62aec2f1eeb14114051f5b09fa47049ebb0a39ae220bdf35e747c98467aa56be8fc90aa7102888ce215edc88a52212b26ee915fdbe2d486
- TLSH T1032142952444A074A7D2C130ECD2D2FB255974874BB4AD58F1EF91F40F790CD92E07DA
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Components/sigthief.py
- SHA256 caf899aedb2b0fe154de2223d86604380d2cf4a47406f881cca680c8a4b063bf
- MD5 57156b83bcfa0c8cbc0fc36aa02a1617
- SHA1 a6aaf0f1e05924e6c6a27918f406c620cacf7a01
- SHA512 63b8944298cdc7323ee7b193efa75018a759d10c6933d430ad62779231b9daca6b2dfd0fcac8e69b5846474b83c1deae5b82606d88c26bebad5bb31d50ff883e
- SSDEEP 192:J/j5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:J6yMSfUU1l
- TLSH T1DF22420C10BC20B0D2E7975C9736648BD666392BBC598E18353CE2175F4837DB2E7D5A
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/GTX Grabber Builder/Components/stub.py
- SHA256 7602997372de338fbe45cb16f6bfe6d0c5bb57634ac7cf64e098a709c939d22c
- MD5 6dc9bbb14ef14c45d4d5d4128dbeb5ef
- SHA1 22b444a2d21707449ee8f5cde4cd87bbd63e255f
- SHA512 cff7bab1052443397a26aa28395d6cb139d2f270def1c0f811d2e92488e7a71daf460461cec8ea79a2f2fcaf3840b8827e9cf2c6f453fa715ff48e997eeabc3e
- SSDEEP 3072:G+RNbizH0U+ma2KJpUrRiwDL0a+P4HmrHnRn:VRNC+UrFq4Kn
- TLSH T1F2A3E826DD162922C3D7E3942A4695C33B1CED67470228307EEC52486F0DAB4D7F9AED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BlankGrabber stealer in memory
GTX Grabber/GTX Grabber Builder/Components/upx.exe
- SHA256 a4240ea0e8a916d15f8391edef9705ab4de1f516dd360f0a336c5358686d434b
- MD5 8a98406e32ed6139bd9e75342d452948
- SHA1 ed77737b88a7351d0bc5f542ddb7ce84f8f95588
- SHA512 f5b17975560d97308a6ee66845225715e82bade9df7bc36821c76fe67fcf8d22929bf21b85e28dd11b7399d0109ab1f3786fd2010c2e5023d3a93d2bd5cf678b
- SSDEEP 12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
- TLSH T196B4230749296B6BF1B1C1740DFA59D224D4FCB6D299A45893F02E2934BA5BECFC2530
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2102592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
522KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 a84e70f79c993beadbfcade43bf51f63d841ecd27eaced77c0976e70fba9de69
- MD5 6f9617311d2fb9cbbfabc57ed46dbd14
- SHA1 899b535d0d942c60d2d95fa4cbe4a80408ccb8bb
- SHA512 1a71de62b8e6798889525ae3479322d93f2aaa35075adefe49d4d820b9542955ae15638046c78ab83c02da628140ece11dab30c1939e440f5260a012024b277b
- SSDEEP 24576:Y7J+UM2Sqzae2jctbEjviXrGBZUlOQeZp9G9SPkeDkFkH1:dUBacRiBiEQGP
- TLSH T139954901E6C1A8CED17AD23E011B7AB6B07A780311F55DCA72ECC7B58B39E08535B679
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
850KB
Virtual Size
849KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
GTX Grabber/GTX Grabber Builder/Components/version.txt
- SHA256 bef1789c0dc34badaf2873723b7baa81fdfd9fef2fe41aad720d389fe0587955
- MD5 dbeadc0f19f3e284489e638819266912
- SHA1 592d7f9af3cca9b530146782ef53f24a7d771570
- SHA512 4e979ddc856ebb42ca63f52287fef175fee7e7c69a0ed4e28fb8b297d1c3fc1812b9bbd641bb1b7dc3d68b13d43881970682a59abb7e0ae5d509cbb76e2d751d
- TLSH T13B31C15F1F81918B01E3B8251B1B5885127442AF89FAFDA9308DA8A56F0E71C13B6B9C
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/Extras/hash
- SHA256 a3a0bcb8bec1eaad047e69983080754930ef816d707cfb0c79bde28914d1c58c
- MD5 cc56774b629cd17fe887ccabf5461161
- SHA1 e4b7db5ed674022b341119bd0d6931f59ef78b46
- SHA512 ad6bbc1ffff9ae24dac299b77efb1d9c844f1d59d1ebf0c8293e9f755c020877b21c392fe64f15e47de48080d7dbc9a9a40311ed3f88670ae817310614291aaf
- MD5 SHA1 SHA512
GTX Grabber/GTX Grabber Builder/Extras/icon.ico
- SHA256 b85b3c08b569688d63aa0202af5e9a0ec9967ddf03ae8de7277b7db81e80e60d
- MD5 d53754dda80461501b1937e581f192e6
- SHA1 e7f812a406a15af20757fc83dcf860c4128f4011
- SHA512 835e712920e50476a475d59127f47f8846dd28c9dff90d842fff0b54eba10ebfd635a2abdcb2c88aab0311e10f66eae11198198cdd64be82b8a116abc9192dbf
- SSDEEP 96:6td9ysZo+9/tX82PPpyVbV3suTlnznFKVaDOzX5mBlhL5kvW:qXyXy/JhPpynznFKiKJ8Ae
- TLSH T19091D909B151736ED00614FD341004CD3F47A476C1EA2E9427A6F6A85FCB73A8AF26D2
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/GTX Grabber Builder/Extras/unblock_sites.py
- SHA256 bf5c32f73990a16835b5b91f08647617dce973a68626ee4921bc5e2c5a07cafe
- MD5 0d1019573b112545f9fd41a4e0acc342
- SHA1 6ab1685e4d4aa3d16307325da3c8c6a65cc1cd2a
- SHA512 d4cdb37acabfe9013aa8cdec6cce9040a9d9c2b52570fa45f1a0750c29860b161d0446ded2d3f31c61676f42ab2be7c01c8cffc09ae64126510ee2d484e1c561
- TLSH T12C315432DC1B05F88362C4D4D54480461CB869A5C144ECF1BEECEA60FB87063EED1F99
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/READme.txt
- SHA256 b30d3a21941310b108baf1dddfc8b363a81a033025ef045d267142eb9f9e78af
- MD5 10a5016f49ef1acacd6998ace35d85e6
- SHA1 49eb4d70a5aea7f79c6e545d87b4863bfa350503
- SHA512 20ba3c146ef15afb526a4bd7842f4cafb0042e2258022fd3deaa8150656d10c45714bdc8c1e48434781841bae3a9f5bd4fbe081c2dfbdd14a22f36bb0b3048f6
- TLSH T1E1C0C00D470C2C3060528080122BEE317E48002402D09CF01488093931FFE936502631
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/config.json
- SHA256 01317ad07923ffb27bdb233cb11d1a6ba8a050272e8360225c71bb6be08c06ca
- MD5 2d7c27a08ea99621f3a99e93b4ea589c
- SHA1 f65ed3b114626436d36ed7fddd8aa9c851fa9c0e
- SHA512 f61f61cc7ae1faaed60fae54f8760879b74b39033a6bde61e66cbe24f2eb32349e5ff5cc59933fad6b960adcdc6384811678467a1dd88587a9323eafd8546b04
- TLSH T1E3900251C4019E311671608188252822D914D6131A21025975F5150C1B71A525989615
- MD5 SHA1 SHA512 TLSH
GTX Grabber/GTX Grabber Builder/gui.py
- SHA256 2541224e02dea793417cb301ee3de7097641b376df779041ff105cdf79692f1b
- MD5 d4516f5f779e1f422bb4fd3f204e1f2e
- SHA1 35c7d2e3ce191b9d67a149f378e249ae419acb43
- SHA512 704fda769a2cc70388f6ca77bde23506862e9e9fe170c8f5fc79b6ca63156f6fa6a55e9dfa763e4b7fb24ed0b5947a7b568b51a5ab167acace8a20c2b9cc396a
- SSDEEP 384:rRBBxtptPNbwhxFGbqWtYh6tr9f2L+vMPNPtLoPjW6CjLKabA117TDtOycaiC7a/:rRxRNbwhxFGbqWtBtoRvL7JwaMwY8
- TLSH T1EE0396A6C72C6A3E1973911DF5462C839D1CD9B3232E45623CFCA27822DC453D2E6E99
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/GTX Grabber.exe
- IMPHASH 1af6c885af093afc55142c2f1761dbe8
- SHA256 6b8fd61dd368291bc6f14ced7fd0530d7cb8f3b769ee1964798515a0b1d43864
- MD5 befb565fe5a30f70e2dc55b065edd766
- SHA1 68116934bf8f03bfd8c75f1f9640d560cd110994
- SHA512 ba34e9f1b6b77d1544182c90f8baef2432a9540696e55fb4d96cae193f9b69b1c35920264b85b72831c869df9e2cb5e5e0d4a4f9ee2011ff8719bc8fc9be89c7
- SSDEEP 393216:3XGD2nwW+eGQRIMTozGxu8C0ibfz6e57g1bmXiWCUI:32DawW+e5R5oztZ026e5WFVUI
- TLSH T1FCD63386A2944CB2D6F7C13642528427F336F9615364C66F23B4B2261BBB3078E3EF55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
49648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32533,
count=40, id=261, version=32533,
count=17, id=260, version=32533,
count=9, id=259, version=32533,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32826,
count=1, id=258, version=32826,
Creal.pyc
- SHA256 21c026e704f60df9bf7c5d0965a69793e2636beda89b356f62c663f0a6db1f6a
- MD5 4d8baf69687eeb20467bb2139711d31e
- SHA1 32da9485f8153f9ede4f5cbae84193b6b2e2e427
- SHA512 1605411a4eb3814f3ad990a95e2b0fd162dba0172eb4cead9f5fce98c4965970ebef1dc3f9d0b48f496262647fe920bf3bb25b03a48b05c29c07b00679a6e9ac
- SSDEEP 1536:OrTaqMamgphoWdUeOPZZYGQmGwWaTgby91bAssUBK+8+pWRBu2lyApq11rRMyq+d:OH7MaNdUcddy9FUmorq1TO25cslszgz
- TLSH T12904F7427568FA7BFC1977782D911B8DB7B5B9A4B34E8723242B10654E0B9E08C31ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
An infostealer written in Python and packaged with PyInstaller.
GTX Grabber/LICENSE
- SHA256 7063655a4dd545d13979d599a96a26cf804ead45751937f63a85b6ebc70477fb
- MD5 0d529b5142a9a8ca2737b546fa1d5321
- SHA1 d9f6893c97198a0293d96c0bbd505ee142982570
- SHA512 739a69b62c24753c95c52c9c47a21d8b0b6d4d215431ac33b477ecb19f7e61362aedfb42133d4435ce9564b85b9eba5de05916ce47b53c52450207f136f3fc41
- TLSH T1B411821E72510B62189A13A05678A8C5B23BB25A7A5F2A84246DF241232A06CC5FB840
- MD5 SHA1 SHA512 TLSH
GTX Grabber/README.md
- SHA256 4b82902e290651a98b7512e37ef56ddbd2b141301ed555e20212f3a50332dd17
- MD5 9526a8f5daab4607c86f79793ca7659d
- SHA1 7a3d14d9f1164fd52ecbacf3cdf92fecb96bf24a
- SHA512 b794ff780e72161a98cac9ebfa50a435c9ff96e955aaf9ca8713a47ff72477fee878062331e7db4898477fd8e2d45cf4396855864fbadfb1ba96e55a8d42dc90
- SSDEEP 192:cqHjy5Eh9CKO+Vcj54sbMvengd+fgsz6DEeCExK:cqHjy5Eh9CKhOj54xve6+5z6DEeDxK
- TLSH T19BE11ABF9A61725117A1C8D3D59A76C3FA32507B97B00018DC28906CEBA0E24D37BBD5
- MD5 SHA1 SHA512 SSDEEP TLSH
GTX Grabber/changelog.md
- SHA256 e1eb49bc87856e201d6d080237f82a6cb4c9bdc5e870c238113a4afb0bda7917
- MD5 69b5d5379cc6ac58537fb1d83d148b05
- SHA1 00cad544ac33a7adf5cf84ee80705584d6115ff1
- SHA512 7a4aeed9b1df82dd31e0df0517da7f0ae6ecc4db5691335c260a8312e7f0c8418f952741888829830252c3b27a86496955691b5282d86af32f4c96696f0ac6a6
- TLSH T1AE311C2A7E9E77B3226202D5920EE0F363B881DC4797622561F5823D3140D6A92FF0D6
- MD5 SHA1 SHA512 TLSH