Extracted

• • Target
    Grape.exe
  • Size 99.7MB
  • SHA256 04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297
  • MD5 4c56b85558e7aba7dfdf492564837779
  • SHA1 1961dbf19dda3d825cfc4899ea0f0efcd31fdb80
  • SHA512 4e3f91922f2d12c2bf9c78ffc9572aa3a3202e40c27b637a448143425d03ac9a202bd0b3260826cbc6dce85c7e9b9381bdacb8c57d711af5d61c766b900cce6c
  • SSDEEP 786432:UqsjvUsvRjAfHvoj7/B10GczN5xwcJXTpWgYVvPM96Rc:t2vU0RjyPoj7p10GuN5xrXTpW8L
  • TLSH
    T1F9387C03E3A610ECC09DC2759B1A9526EEB2BC450735B6DF266467212F76FE06B3DB10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionhijackloaderloaderpersistencespywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    LICENSES.chromium.html
  • Size 4.6MB
  • SHA256 34cbc992a26037e2e57f948ab34cf0f65c2a50503580c54309ed63246681fbd7
  • MD5 19a7200e2813cfa87d728205db3de87a
  • SHA1 b24e2313e0ecbee03fc132f24fe54e84850513f2
  • SHA512 94b54bef938aac9156ffcd9c83d75cc8564849c1c5042de060c31f190e406f29fdf046a961a72fb71f2a5b3b41eb13a65f90fada99ba34d83a2717edee102cc9
  • SSDEEP 24576:5ueBpmnLiLOU5rUrPKThrkUAQwyfQlQue:U2pmLALFyyVEl+
  • TLSH
    T14026D66BBF49037306F282626A4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    ffmpeg.dll
  • Size 2.2MB
  • SHA256 1a5ea394d48ec44bdffc87a0a414553acd7496058546fda51f2aa7afc774d277
  • MD5 8b9523d7903086ac856883180ebacb62
  • SHA1 2dd60ab51c395faee96d3ce88936124c6cb8cdb1
  • SHA512 5047265d676c0422d48466fd670f406e4cadb1f673b3caca14fe475e710949f8daae3acf4ed59a1e0a4aec322761bd1f606eeabc39b37e6b9a4f523635a33be4
  • SSDEEP 49152:+spMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:+4b2aux6LNbHD
  • TLSH
    T1BCB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    libEGL.dll
  • Size 367KB
  • SHA256 6221e3e2120975c8e7374f628f85eceed6afacc98d214fc27253fd62003defa0
  • MD5 cdea3454c60966cb4c3a3408ddfc017b
  • SHA1 a4b2d40c25146e1655100ad504a26044113ee979
  • SHA512 c1a342d2301860831420de61e94b89b85e7d49ef365759869ee9bfec576ea4ec0c7ae9ebae357f0404d46a6fffaf5c5881cc056df4c8b246e424f7e1a26fc132
  • SSDEEP 6144:Sj0Aq7pjRaVlgZrNJserEW848VvGy1+Gew8YUoZ9JctrQ:Sj0F7p4lgZZJsmbk+Gew8+1
  • TLSH
    T1FE847C16F7A048BAD066D434CE338A02DA72BC8E0E65A75F3395425D2F77BA45E3D720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    libGLESv2.dll
  • Size 7.6MB
  • SHA256 890a9fdf8216f97142c6f96545cc2e1026dcef80b81c947d63cf28932f0d5697
  • MD5 097582ff54ab078ff27cf8ba939f9d31
  • SHA1 ddf15796cac5937bfaae19b80520571df22193c5
  • SHA512 bee0a84c5469cb0a854c703cc20e34e9e76067eb65c8be8bebf2cda02b410e1f457e9fab596ea594610b1c7f7bbafbd1c778d348ae4a268866cf60fba39db63a
  • SSDEEP 49152:Cwc0N9GQGcTsiDnOiY27ki8RCUOZ6wPf9W/GYyBG4c1DepY/23LdIdtnvEIF/9ls:kGOiY27BU8f23hVezl4uQgL3A+BO
  • TLSH
    T12B867C03E1A145D9C41EC278C717A622EB35BC891A61F39F229873213FB6FA15B2F754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    swiftshader/libEGL.dll
  • Size 392KB
  • SHA256 91e118f71d5605b24d58002f152fe7bfe95af85a0027076a944c62609357e16e
  • MD5 a686afbd8b63a663ab6af10ae14b4f38
  • SHA1 76f1d873233dc5a2ffd5ed8b003614825755236c
  • SHA512 b5307e6b254491cbc11bd18395036604ac333f65ee3d64cbd62f2f12bb615f080f1740c3e55e69e3758fa19daefcb8b9bd3cbe19956b77e7ca7a539a7c9ccae5
  • SSDEEP 6144:C3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAtaWL0W:C3lNvxdUn9iqCfsFcIJqUtar
  • TLSH
    T1FE847D16F7A048B9D067C034C9278A42DA71BCDE0F65E29F2395425E2F77BE49E39720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    swiftshader/libGLESv2.dll
  • Size 3.6MB
  • SHA256 f1d11680aeba15d3f31fd3982da7a78b460705fd54e6033fd791e5298cdbfcd5
  • MD5 5d71cefb8378b025f941eba3ccf328e3
  • SHA1 e6de9c0de7e2c9157bbd4c01f26d2fde6f34e9f4
  • SHA512 65fdeda1239de431ba4694123ee136f035b21d635d1e17982690e2103d04632023c82571d467dc2fbb349eb8f36765cbaff5e0ea93bd49b64a7fb797bdd79120
  • SSDEEP 49152:UE8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:i7GkhDpoWJtaPm9MQ3cA3
  • TLSH
    T12006E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    vk_swiftshader.dll
  • Size 15.9MB
  • SHA256 c52beb5c1a0bb662368986a6be0f6bdc47d7efb0e5b5c948a2f36675997e9c5e
  • MD5 dafe840c9ec8f80afacbfbe893b0de90
  • SHA1 cc20821715eb5b2441394f8f0378e61eee522292
  • SHA512 287764609ca8dd6464258ddf4c2679f14e5a7b4b9290f363dcf1f81e4636e0b47ed13ee279ae148b390ab14455165a896a619b617a6c04736673d447e42b13cb
  • SSDEEP 98304:nvdxnCXb79l+a0doAmuaZ3Wpzwd9OMof2F5BSYFICa3DZtqST0EWUXmIc/J1:nzW901tpzwblF5BS27a3DZmemIEJ1
  • TLSH
    T1DCF65A03F6A98099C05DD5799F17E332E670BC84592A7BAF77913B262F71B602B2D304
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16