fae5d6679598eb6afc6af798a598defc15fdd0452e938c896f42bfc95b780c1f

Sharing

Copy URL Twitter E-mail

General

Target
Grum.zip
Size 2.1MB
Sample260826-2djrnsxdma
SHA256 fae5d6679598eb6afc6af798a598defc15fdd0452e938c896f42bfc95b780c1f
MD5 373624835f3b1c823748800cc5c23115
SHA1 2bd179ba39a1bfd394f509788e1dd0a4a43b96b3
SHA512 a61b60884d3913f873558026fe11449dc276ab1212a5cd777e113976e0e80fba7884751b3e58c31c5fdaf55b301c8bf45b2a0b8e228c68cf5d2ecfbf3fffcb22
SSDEEP 49152:F4qJ66i36Z+unHRUxh+bFHO6etEeudS3vdsHu+CL3PxYQRFP:C463OxUxI46etEHdSeHu+kYaV
TLSH
T1B0A523B7DB915301E97B167156DF4A98BBE49103AF70BB07140C108B8CE3BAB6F0265B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  builder+bin/Builder.exe
- Size 920KB
- SHA256 59a0bd73b5a416de25b2a00c5b23561fbcecb832a4043884da30a4b4682d7a25
- MD5 395afe91137880f7a2e870f1c7c77349
- SHA1 eec76065fc669a14c2d6a6b5e88147b5a1e68103
- SHA512 72d1ed249ba704f5cc9e54203eb945ddaa7618a2cf0c11382bd280b60a8b67d9b4933fcfc8f4e1c349b32cbb6b3f45431a7bf173ca913290b17ddb2828adf9b8
- SSDEEP 12288:4m/PJXlqGlWebjr0Yl5sDNfztYH6aTyxtjbtUjwXOwNw0toN48kMB0OGA:xBxl/bjr0YlGDNfztYHcHUMwC8dB0O
- TLSH
  T185155D31F6918437E177397AEC575299587CBB412E24AC0B3AEC2E4CAF797C13C26246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  builder+bin/out.exe
- Size 32KB
- SHA256 a08df6e72fac6582b670fdbdcb22a2c9241739ed57552a619539f6e38eb7edb3
- MD5 0ea9146650da844d5554b093b996eb2a
- SHA1 ac8c517ace3bfb7593e51a7e36e4131cdcaf6cd1
- SHA512 8dc006709d5315f5d3f721f7371526dd267fda3c32e730ef418fa624d9949b8ccd7f3049b9017e3e4517bff21f31afee4064cb13d9e1971cfa2a695062c34103
- SSDEEP 384:eQZFbSKQ4ABdh6oPWAe1jO/CDUEhWdieqvUnMXY:e9VrAoPo1jO/UsdJqvLXY
- TLSH
  T1BCE20A7BA55A7CB2DDB03A301A4DB6205EA59A307F39F8C5D39487452CFD6C0B42854B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Adds policy Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  grum/build.bat
- Size 1KB
- SHA256 8f8e6d978eeb8bb40a3ca1cc905623c6f2e3a02700876217b46a827c275ffde0
- MD5 3cc2dc55f1e9339f4e5882bdcb470778
- SHA1 2da4e923ad0bc4889220144619c552345114ed97
- SHA512 c8eef2eb6227c7af84cf8e2494fddc33edef7296dfd86c1050c8181b4747cbde978d39510e09edc92094327207c1b1686631a5c617ec0d29d1d678fa707afbdb
- TLSH
  T1B83189288049C946F436BD89E728BC147448C5675FA05A3D12ACB2DFE583249DCBEFD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  grum/grum/build.bat
- Size 1KB
- SHA256 8f8e6d978eeb8bb40a3ca1cc905623c6f2e3a02700876217b46a827c275ffde0
- MD5 3cc2dc55f1e9339f4e5882bdcb470778
- SHA1 2da4e923ad0bc4889220144619c552345114ed97
- SHA512 c8eef2eb6227c7af84cf8e2494fddc33edef7296dfd86c1050c8181b4747cbde978d39510e09edc92094327207c1b1686631a5c617ec0d29d1d678fa707afbdb
- TLSH
  T1B83189288049C946F436BD89E728BC147448C5675FA05A3D12ACB2DFE583249DCBEFD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  grum/grum/msobj80.dll
- Size 56KB
- SHA256 803d06c37d7296bf9f2a9c34eb7bebae218b5f12c18d1dd110eaaa5d323c8268
- MD5 8c10b48aa8fd9b56208d945b4e1ea028
- SHA1 b37d80ef629907398c26ef9775ee0e817b785b26
- SHA512 ba1996dff01f55ba165f6ebd66efbbaee9646a255ab1855ef91a52e4abf05d55a3d10b0d1ec9977a70f9b467caa45c35886802d002c96478d6809c1f8e7732b7
- SSDEEP 768:Ffg7rFFrkzrcRrz2prDj8Mp7FCqSGHlpdhohGXZtmeqEQwVsc26OftfQgVvzbf3z:KZFgzQRv2pvLhnvdyGgP5zGcv33UDoN
- TLSH
  T1E6438E47B6C582B6C35226749FA93B3B67FDE3040E2B9F5347A40E405F50999DA3C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  grum/grum/mspdb80.dll
- Size 251KB
- SHA256 ef18e847ba76a05c013425621ed3427e61c43c1edd9a190d4c25d83016946655
- MD5 23f2e43b378f2c1df5716decaf647ee5
- SHA1 4a02408fd0d48df8f6494ba4121560e318735cc3
- SHA512 a2e31ca55dd31be4288d3a5808411e8960cd31685ec6da9389adf1a7010daa1ea14265836ba3bec84122679b18d2a6c43be303a1bbedea103ab43e025fe5f771
- SSDEEP 6144:q52oDtZLRrxOWK8HhSSDI5c4y2nKDNk2CA5li:TCRrxOWK8HhSM4y2nKDNkki
- TLSH
  T1C044AE92F6C0447ADAE77330CB19A3A817FA9710193B9D47639A0E85FF21542D63E393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  grum/grum/resources/XorIt.exe
- Size 1KB
- SHA256 fef7cbcd7108d3c0a1448e6d5bf5edeeb935e031ea7df53b4ee007f1f4617677
- MD5 73925b6fdf052319fe5e44f1122c0009
- SHA1 ece7cd68a69e3a52cc970f738115fda62efba996
- SHA512 d8960a04408af9fb2bfa6130af4d5bcb0cc21bc86375227ce22e5bc246e105f0dfd4e71570cfd463a7d27029025de4606f39af236b1c1b7a279f5960f6fa3007
- TLSH
  T10231000F5E2CA913C2408DB113941C94DBEBC16055DAECE29B31764108A8EFBC7F4702
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  grum/msobj80.dll
- Size 56KB
- SHA256 803d06c37d7296bf9f2a9c34eb7bebae218b5f12c18d1dd110eaaa5d323c8268
- MD5 8c10b48aa8fd9b56208d945b4e1ea028
- SHA1 b37d80ef629907398c26ef9775ee0e817b785b26
- SHA512 ba1996dff01f55ba165f6ebd66efbbaee9646a255ab1855ef91a52e4abf05d55a3d10b0d1ec9977a70f9b467caa45c35886802d002c96478d6809c1f8e7732b7
- SSDEEP 768:Ffg7rFFrkzrcRrz2prDj8Mp7FCqSGHlpdhohGXZtmeqEQwVsc26OftfQgVvzbf3z:KZFgzQRv2pvLhnvdyGgP5zGcv33UDoN
- TLSH
  T1E6438E47B6C582B6C35226749FA93B3B67FDE3040E2B9F5347A40E405F50999DA3C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  grum/mspdb80.dll
- Size 251KB
- SHA256 ef18e847ba76a05c013425621ed3427e61c43c1edd9a190d4c25d83016946655
- MD5 23f2e43b378f2c1df5716decaf647ee5
- SHA1 4a02408fd0d48df8f6494ba4121560e318735cc3
- SHA512 a2e31ca55dd31be4288d3a5808411e8960cd31685ec6da9389adf1a7010daa1ea14265836ba3bec84122679b18d2a6c43be303a1bbedea103ab43e025fe5f771
- SSDEEP 6144:q52oDtZLRrxOWK8HhSSDI5c4y2nKDNk2CA5li:TCRrxOWK8HhSM4y2nKDNkki
- TLSH
  T1C044AE92F6C0447ADAE77330CB19A3A817FA9710193B9D47639A0E85FF21542D63E393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  grum/resources/XorIt.exe
- Size 1KB
- SHA256 fef7cbcd7108d3c0a1448e6d5bf5edeeb935e031ea7df53b4ee007f1f4617677
- MD5 73925b6fdf052319fe5e44f1122c0009
- SHA1 ece7cd68a69e3a52cc970f738115fda62efba996
- SHA512 d8960a04408af9fb2bfa6130af4d5bcb0cc21bc86375227ce22e5bc246e105f0dfd4e71570cfd463a7d27029025de4606f39af236b1c1b7a279f5960f6fa3007
- TLSH
  T10231000F5E2CA913C2408DB113941C94DBEBC16055DAECE29B31764108A8EFBC7F4702
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  spm/admin/flags/mypage.php
- Size 668B
- SHA256 b5780fb3c0bd4c915dee9876ca36b9f137b09dfc5cbc87825a2f8413766ea641
- MD5 e16d47ac1923990c5f0f7a12fdecc479
- SHA1 5b152742370bba525e92fea798fa3e48d95cd75c
- SHA512 f651073daca1acd5e852095290b2586bcdeb1e7cf88b2426c47d6bb697a60fa92905415f9754e6a6e57b5554b7858f71e13071606d5b30b0244bca2eed5ca18c
- TLSH
  T10E019EBDA508211D865186B07EF1EA4C5D564682D3C588C499C5D4A7F0F4BCBCC231D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  spm/admin/tasks.php
- Size 6KB
- SHA256 3c938b0aedde484e86d340224d327f51596aff466e3f582c5d8a0e25d7b206c7
- MD5 c3d914e823c105dbceea69de7df75085
- SHA1 b1a396e39fcbf6d6fdfb0c73fa3d485fd6d65380
- SHA512 3dc3ee1b537d2ba8fa5888250b7fbf81960a2b1118e6c21890f9d90004e0cf77119da68a7fcc751e4d74d63855ce643025d9efe6eb9ade5891442fa754b81f0b
- SSDEEP 192:HiJNojaW7go+R1BUnLZqK/M3eGLymFqaJZRb:6ouib03Xz
- TLSH
  T179D1424DFDC2A012213B4C3492BB6EA728A5515B72188C593C5F40BF9FC6291D3FC94E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  spm/admin/tasks2.php
- Size 6KB
- SHA256 f5d5f2547f7f5d50b53261a0e9abe4391285f99b58ac781c87851f9906895069
- MD5 776de28d69671cff01f7b49b8ad0d1df
- SHA1 ec210b3c30d42abeb79bc0f3e6e556e13baf8cd6
- SHA512 3e7da0d494ffb99d12c3688186fb0d6957d646d54b2daa55c1a1aef0fbae77d5f672ddf1effadfa84c3fb0cfff220c7e8c03d6705aebd92f54e49a87cb37b926
- SSDEEP 192:HiJ9ajaW7goPEBUnLZqsM37GGYm2qtmZR9:Kaui03PE
- TLSH
  T11AD1544DFEC2A012213B4C3592BB5AA728A5505B72188C593C5F40BF9FC7291D3FC95E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  spm/show.php
- Size 1KB
- SHA256 31132e84e8bf97c0376c21cdd01634708c7d0e4751df139a294edc38474f3897
- MD5 22fdc019547e5d85bc0cd57a2a577f50
- SHA1 27952a48c1cffec3d5318a0fe9a35a56f05da999
- SHA512 629c23f70b2be7422af45049e3cf24447396ad4e02d327e892a1616acf7e26a4783b3730432b4b6634d5c7a366954dad7952f4a1b0e9a3e189d313012c0ddba0
- TLSH
  T1AB317844384621A1127B07B9978F40F5ED91621F251B1D2D3A0E54E40FB3464FEFD994
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28