0c157175f3607a5ac90549972db5a913862e69834f6fc8e26380b2c6414b14ea

Sharing

Copy URL Twitter E-mail

General

Target
GRUM.zip
Size 3.2MB
Sample260730-tdy8csvxhx
SHA256 0c157175f3607a5ac90549972db5a913862e69834f6fc8e26380b2c6414b14ea
MD5 a741d45aa2fa0cb874b1ebae1dd16a9f
SHA1 d1c08a06980ce2a34142f6ff7aaba352ba36bced
SHA512 7b60dcd5ea7c4232edc550c5dbd8fc553b8e24451340dc4bede241d4258429ad88b1ee63769b680da684a4f5a55c8a96515c1a3bed2950c1b788c1ba2880588d
SSDEEP 98304:PJExKHFeXsro1vFYLeCofdHxLF8GlT9IAG:PJMKHFeV1vFZCoFRBB9E
TLSH
T183E522EEABC02315E12B52B452AE594877E45005F320B31B57243597CDDBEA2BF133AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  builder+bin/Builder.exe
- Size 920KB
- SHA256 59a0bd73b5a416de25b2a00c5b23561fbcecb832a4043884da30a4b4682d7a25
- MD5 395afe91137880f7a2e870f1c7c77349
- SHA1 eec76065fc669a14c2d6a6b5e88147b5a1e68103
- SHA512 72d1ed249ba704f5cc9e54203eb945ddaa7618a2cf0c11382bd280b60a8b67d9b4933fcfc8f4e1c349b32cbb6b3f45431a7bf173ca913290b17ddb2828adf9b8
- SSDEEP 12288:4m/PJXlqGlWebjr0Yl5sDNfztYH6aTyxtjbtUjwXOwNw0toN48kMB0OGA:xBxl/bjr0YlGDNfztYHcHUMwC8dB0O
- TLSH
  T185155D31F6918437E177397AEC575299587CBB412E24AC0B3AEC2E4CAF797C13C26246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  builder+bin/out.exe
- Size 32KB
- SHA256 a08df6e72fac6582b670fdbdcb22a2c9241739ed57552a619539f6e38eb7edb3
- MD5 0ea9146650da844d5554b093b996eb2a
- SHA1 ac8c517ace3bfb7593e51a7e36e4131cdcaf6cd1
- SHA512 8dc006709d5315f5d3f721f7371526dd267fda3c32e730ef418fa624d9949b8ccd7f3049b9017e3e4517bff21f31afee4064cb13d9e1971cfa2a695062c34103
- SSDEEP 384:eQZFbSKQ4ABdh6oPWAe1jO/CDUEhWdieqvUnMXY:e9VrAoPo1jO/UsdJqvLXY
- TLSH
  T1BCE20A7BA55A7CB2DDB03A301A4DB6205EA59A307F39F8C5D39487452CFD6C0B42854B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Adds policy Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  grum/build.bat
- Size 1KB
- SHA256 8f8e6d978eeb8bb40a3ca1cc905623c6f2e3a02700876217b46a827c275ffde0
- MD5 3cc2dc55f1e9339f4e5882bdcb470778
- SHA1 2da4e923ad0bc4889220144619c552345114ed97
- SHA512 c8eef2eb6227c7af84cf8e2494fddc33edef7296dfd86c1050c8181b4747cbde978d39510e09edc92094327207c1b1686631a5c617ec0d29d1d678fa707afbdb
- TLSH
  T1B83189288049C946F436BD89E728BC147448C5675FA05A3D12ACB2DFE583249DCBEFD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  grum/grum/build.bat
- Size 1KB
- SHA256 8f8e6d978eeb8bb40a3ca1cc905623c6f2e3a02700876217b46a827c275ffde0
- MD5 3cc2dc55f1e9339f4e5882bdcb470778
- SHA1 2da4e923ad0bc4889220144619c552345114ed97
- SHA512 c8eef2eb6227c7af84cf8e2494fddc33edef7296dfd86c1050c8181b4747cbde978d39510e09edc92094327207c1b1686631a5c617ec0d29d1d678fa707afbdb
- TLSH
  T1B83189288049C946F436BD89E728BC147448C5675FA05A3D12ACB2DFE583249DCBEFD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  grum/grum/msobj80.dll
- Size 56KB
- SHA256 803d06c37d7296bf9f2a9c34eb7bebae218b5f12c18d1dd110eaaa5d323c8268
- MD5 8c10b48aa8fd9b56208d945b4e1ea028
- SHA1 b37d80ef629907398c26ef9775ee0e817b785b26
- SHA512 ba1996dff01f55ba165f6ebd66efbbaee9646a255ab1855ef91a52e4abf05d55a3d10b0d1ec9977a70f9b467caa45c35886802d002c96478d6809c1f8e7732b7
- SSDEEP 768:Ffg7rFFrkzrcRrz2prDj8Mp7FCqSGHlpdhohGXZtmeqEQwVsc26OftfQgVvzbf3z:KZFgzQRv2pvLhnvdyGgP5zGcv33UDoN
- TLSH
  T1E6438E47B6C582B6C35226749FA93B3B67FDE3040E2B9F5347A40E405F50999DA3C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  grum/grum/mspdb80.dll
- Size 251KB
- SHA256 ef18e847ba76a05c013425621ed3427e61c43c1edd9a190d4c25d83016946655
- MD5 23f2e43b378f2c1df5716decaf647ee5
- SHA1 4a02408fd0d48df8f6494ba4121560e318735cc3
- SHA512 a2e31ca55dd31be4288d3a5808411e8960cd31685ec6da9389adf1a7010daa1ea14265836ba3bec84122679b18d2a6c43be303a1bbedea103ab43e025fe5f771
- SSDEEP 6144:q52oDtZLRrxOWK8HhSSDI5c4y2nKDNk2CA5li:TCRrxOWK8HhSM4y2nKDNkki
- TLSH
  T1C044AE92F6C0447ADAE77330CB19A3A817FA9710193B9D47639A0E85FF21542D63E393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  grum/msobj80.dll
- Size 56KB
- SHA256 803d06c37d7296bf9f2a9c34eb7bebae218b5f12c18d1dd110eaaa5d323c8268
- MD5 8c10b48aa8fd9b56208d945b4e1ea028
- SHA1 b37d80ef629907398c26ef9775ee0e817b785b26
- SHA512 ba1996dff01f55ba165f6ebd66efbbaee9646a255ab1855ef91a52e4abf05d55a3d10b0d1ec9977a70f9b467caa45c35886802d002c96478d6809c1f8e7732b7
- SSDEEP 768:Ffg7rFFrkzrcRrz2prDj8Mp7FCqSGHlpdhohGXZtmeqEQwVsc26OftfQgVvzbf3z:KZFgzQRv2pvLhnvdyGgP5zGcv33UDoN
- TLSH
  T1E6438E47B6C582B6C35226749FA93B3B67FDE3040E2B9F5347A40E405F50999DA3C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  grum/mspdb80.dll
- Size 251KB
- SHA256 ef18e847ba76a05c013425621ed3427e61c43c1edd9a190d4c25d83016946655
- MD5 23f2e43b378f2c1df5716decaf647ee5
- SHA1 4a02408fd0d48df8f6494ba4121560e318735cc3
- SHA512 a2e31ca55dd31be4288d3a5808411e8960cd31685ec6da9389adf1a7010daa1ea14265836ba3bec84122679b18d2a6c43be303a1bbedea103ab43e025fe5f771
- SSDEEP 6144:q52oDtZLRrxOWK8HhSSDI5c4y2nKDNk2CA5li:TCRrxOWK8HhSM4y2nKDNkki
- TLSH
  T1C044AE92F6C0447ADAE77330CB19A3A817FA9710193B9D47639A0E85FF21542D63E393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  spm.FiX-XYLiBOX/ExecuteMe.exe
- Size 446KB
- SHA256 ea17c02df8860de6fbb1855a8291871727a2deffe28b0ac38e59cbba7f20b380
- MD5 d0b4de3c07f9661dbf1f9155a437d2dd
- SHA1 b33b3130e76b5915f06d5804cd120ef40ad67c53
- SHA512 265d2c0cf1a45bb75b28a46b0d17df61caba373425b82bf43cdb6f14108c42f64945742ed4b69f8e633abff1ad6cba8af760f1ef26dcc29f03ce687ce4619d17
- SSDEEP 6144:6WqCwu1llCHJNpPFKloxTG+9Q71fxdVteHlpqI4luU+y:6W7CH7pP4lgMVteHl2Z
- TLSH
  T16AA49C1277B8F1A1D48866301C5E55FA9BE50D83AD003E817AAE7F166F14F46EDCAB0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  spm.FiX-XYLiBOX/admin/tasks.php
- Size 6KB
- SHA256 3846c12c1d804541c4ede8307ebc90c6331cb947b3c78d32ac8ea005da286a4a
- MD5 daf331a2d78b1a1a658fd7ec51506786
- SHA1 f511c8c214e0cdd92d97b01d68c3a3624db2e663
- SHA512 9dfa46c650cefcc0c9e55ef403159512059015a1230cba49b3ce25f45536db31dbfa20f4c1be485c70a6ec340d6e57b6792671031cbc0fb05158b3489daa0a02
- SSDEEP 192:R+JNojaW7go+R1BUnLZqK/M3eGLymFqaJZRb:Youib03Xz
- TLSH
  T1EDD1424DFDC2A012213B4C3492BB6EA728A5515B72188C993C5F40BF9FC6291D3FC94E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  spm.FiX-XYLiBOX/admin/tasks2.php
- Size 6KB
- SHA256 7444c51113a3dae7f01d58abce14816ccc8514e538f0de4d1a1ad3d42c4a36a9
- MD5 a7f329ce70b8d2454986b9cba02cd52f
- SHA1 313024842b950c33274c8ddb007070ef58530c15
- SHA512 dd888bd7a15b4bb33261156be9b55a68430fdadcf8148b6574428527298ad4c60c30b96eb028aeb65ba58550aba6d66af41a6ee2d27188981b469c542fb63e06
- SSDEEP 192:R+J9ajaW7goPEBUnLZqsM37GGYm2qtmZR9:Iaui03PE
- TLSH
  T18FD1434DFEC2A012213B4C3592BB5AA728A5505B7218CC993C5F40BF9FC62A1D3FD95E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  spm.FiX-XYLiBOX/install/index.php
- Size 2KB
- SHA256 cfd02fb60d1daf36b51797bb167b8876b3ff659277350f0009b8c94bfbcde130
- MD5 fa81f9561e025c0fae1e5a5401aa6236
- SHA1 9c99126fde77e41e73c1bd33692d0421e3e2ba3e
- SHA512 e72b9a38469a9e62b44c9d678ecb0fb791a175a60eb5a2f63eff3f6f54fd375f2908052a23e675df7ae9676ea2e0a8d5b9c77e78c52ca0f4aae61f3d89f7a958
- TLSH
  T1805171A1784BAE5493620D7487B1CC06EC4DF13606D64CE26CE8522EB7C0D0E2BDAD9B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  spm.FiX-XYLiBOX/show.php
- Size 1KB
- SHA256 2277802e2a418e667591e95abb523e716e98624abbfe974ab420d40ae90f1f26
- MD5 d1f25730125ad916a6f2e28e731e7f5e
- SHA1 35feeb9f6b19dd522a34e09f1395c9f9d6822d29
- SHA512 08b55374b7e862c1bb11f68a2974cf2d35c3e0ea416716b416d25cd0dc915f768132a8d77aaf274b54c6ca12ecabd1c6a118ef98df47ece8025146dd60ea8209
- TLSH
  T172317584384621A1127B17B9978F40F5ED92A21F251B1D2E3A0E54E40FB3964FEFE9D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  spm/admin/flags/mypage.php
- Size 668B
- SHA256 b5780fb3c0bd4c915dee9876ca36b9f137b09dfc5cbc87825a2f8413766ea641
- MD5 e16d47ac1923990c5f0f7a12fdecc479
- SHA1 5b152742370bba525e92fea798fa3e48d95cd75c
- SHA512 f651073daca1acd5e852095290b2586bcdeb1e7cf88b2426c47d6bb697a60fa92905415f9754e6a6e57b5554b7858f71e13071606d5b30b0244bca2eed5ca18c
- TLSH
  T10E019EBDA508211D865186B07EF1EA4C5D564682D3C588C499C5D4A7F0F4BCBCC231D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  spm/admin/tasks.php
- Size 6KB
- SHA256 3c938b0aedde484e86d340224d327f51596aff466e3f582c5d8a0e25d7b206c7
- MD5 c3d914e823c105dbceea69de7df75085
- SHA1 b1a396e39fcbf6d6fdfb0c73fa3d485fd6d65380
- SHA512 3dc3ee1b537d2ba8fa5888250b7fbf81960a2b1118e6c21890f9d90004e0cf77119da68a7fcc751e4d74d63855ce643025d9efe6eb9ade5891442fa754b81f0b
- SSDEEP 192:HiJNojaW7go+R1BUnLZqK/M3eGLymFqaJZRb:6ouib03Xz
- TLSH
  T179D1424DFDC2A012213B4C3492BB6EA728A5515B72188C593C5F40BF9FC6291D3FC94E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  spm/admin/tasks2.php
- Size 6KB
- SHA256 f5d5f2547f7f5d50b53261a0e9abe4391285f99b58ac781c87851f9906895069
- MD5 776de28d69671cff01f7b49b8ad0d1df
- SHA1 ec210b3c30d42abeb79bc0f3e6e556e13baf8cd6
- SHA512 3e7da0d494ffb99d12c3688186fb0d6957d646d54b2daa55c1a1aef0fbae77d5f672ddf1effadfa84c3fb0cfff220c7e8c03d6705aebd92f54e49a87cb37b926
- SSDEEP 192:HiJ9ajaW7goPEBUnLZqsM37GGYm2qtmZR9:Kaui03PE
- TLSH
  T11AD1544DFEC2A012213B4C3592BB5AA728A5505B72188C593C5F40BF9FC7291D3FC95E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32