🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Grandoreiro


Vendor detections: 8


Intelligence 8 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
SHA3-384 hash: 7ffd28d19843efd9946516e6949c73137be8e47700f39a5ae5aaf9cb9c86569fb901638591dcdd7ba1b8eeee4d6ebaae
SHA1 hash: ec524ebb2862169d83501e43817026f5518e8e91
MD5 hash: ecb07d1c77939bd1a2aa029f08e86ffc
humanhash: ink-stream-uniform-glucose
File name:07858Liq46903_Conc_Orig-25MCO.zip
Download: download sample
Signature Grandoreiro
Create hunting rule
File size:3'042'322 bytes
First seen:2026-10-29 06:24:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:QYxnOP1rCcEn7CBAvPVTIBSpfhngpumyM6WTVgLQdzGHs/u7H/rbZr8KMoATiCqL:9OAqOvdcBufhngp99ZzxGrTbV8fTiCLW
TLSH T1E4E533944AA79C42BD0D0BECC98722FC6D7AEB3E1F57169F3C9E628476265C4E35C800
Magika zip
Reporter abuse_ch
Tags:geo Grandoreiro MEX zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
CH CH
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:hqzcth2.pdf
File size:25'715 bytes
SHA256 hash: 91258cc25e35feb951a9b3e6f99f4b082c6220a2fff982e0a45bc5c17f4932b5
MD5 hash: ae228fcc1253d7b6f62b0d25f4a8cd8c
MIME type:application/pdf
Signature Grandoreiro
File name:qeuu1.xml
File size:47'248 bytes
SHA256 hash: 992484d2d4aa3d9522406823c5fafe7809be48ee4bc13733bf14eea333c61234
MD5 hash: 5e84f38f9b3b0b3cd01babaadf33abc1
MIME type:application/x-dosexec
Signature Grandoreiro
File name:ohbag1.pdf
File size:47'435 bytes
SHA256 hash: e90c37b856dd3dbee0d623632637d9f711ac888ff6748bf24266fdb54bae1d83
MD5 hash: a8e862d02033b94060eeec6416d9c1ee
MIME type:application/pdf
Signature Grandoreiro
File name:zilv2.xml
File size:43'600 bytes
SHA256 hash: bd69bc6eb3c6df8ee74532723c6bcfa9e76c52113452dd777fd2fd192b07bf08
MD5 hash: e08dd05ee2aca2a21038d16d22d2e5ff
MIME type:application/x-dosexec
Signature Grandoreiro
File name:Pol_RecepGHLLExp0kdhgbcCialxune_94VED_83D2B5SELMQFirm.vbs
File size:4'253'431 bytes
SHA256 hash: 039851fe0310d0e281fe0068ebe546dfaef34838bd506fd341bd4e71a8cf1530
MD5 hash: e4f00e849e5a0e7575f22e66b5618070
MIME type:text/plain
Signature Grandoreiro
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4700bc5d-a83e-4d88-83da-c2046937b036/
Detection(s):
SecuriteInfo.com.GT.VB.Remcos.2.FCFE28F6.43111182.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae2e693b121dd519dce8fbf
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-29T04:29:00Z UTC
Last seen:
2026-10-29T09:50:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61/results?tab=lookup
Score:
62%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61
Verdict:
Malware
YARA:
2 match(es)
Tags:
ADODB.Stream COM Behavior Trace DeObfuscated Executable Microsoft.XMLDOM Obfuscated PDB Path PE (Portable Executable) PE File Layout Scripting.FileSystemObject Shell.Application SOS: 0.76 T1027 T1059 T1059.005 VBScript WScript.Shell Zip Archive
Link:
https://app.malva.re/file/ecb07d1c77939bd1a2aa029f08e86ffc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61/
Threat name:
Script-WScript.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-10-29 06:24:29 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q726t6mfkz7kuu6nc3u7k3qdfrjvfyhp2wcfj3a5dylwzqmgbjqq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
adware defense_evasion discovery execution link pdf persistence qr ransomware spyware
Link:
https://tria.ge/reports/261029-g6sj3axt4j/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WIN_Malware_Unknown_ForgeAuto_4286e0e1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_598a7881_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Grandoreiro

zip 87f5e9f985567eaa53cd16e9f56e032c5352e0efd58454ec1d1e176cc1860a61

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4042213/
  
Delivery method
Distributed via web download

Comments