MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c
SHA3-384 hash: 395230c75740c960faed2fde571c2638fa365f34a2d776bd23146f3eaf9799d6c66a58bc652e546a0acb02c9b3e26df1
SHA1 hash: d9de46db15f358d6c6777134932ea7b1e57e3acc
MD5 hash: 340365f7123c5449c53af6eed45ee75b
humanhash: salami-princess-cup-steak
File name:z74Danfe-Pedido18042024.msi
Download: download sample
File size:17'726'464 bytes
First seen:2024-04-19 17:10:29 UTC
Last seen:2024-04-19 17:28:39 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:yf/9Lm8KkEQMvRKGpw4dyJQFZVAuTcBJqx4KBBBz68qi4h1xAsZP2nLS7vZ2YX2W:ydMBaWnhTcBeOfi4y5LpFTp
Threatray 6 similar samples on MalwareBazaar
TLSH T15F077D13B684953AC49B0A3ADD27DA74983F7E216E664C473BF83E4D2E316412D3B643
TrID 70.2% (.MSI) Microsoft Windows Installer (454500/1/170)
9.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.1% (.MSWMM) Windows Movie Maker project (46500/1/9)
6.8% (.MSP) Windows Installer Patch (44509/10/5)
5.0% (.XLS) Microsoft Excel sheet (32500/1/3)
Reporter FXOLabs
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
BR BR
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm crypto fingerprint grandoreiro keylogger rat
Link:
https://www.filescan.io/uploads/6622a5a947bfd8641eaf8f21/reports/01965c87-31b3-41a2-9c11-8a91b932c593/overview
Verdict:
Malicious
Labled as:
Grandoreiro.AR.gen
Link:
https://www.hybrid-analysis.com/sample/b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1428882
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
11%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c/
Threat name:
Win32.Trojan.Grandoreiro
Create hunting rule
Status:
Malicious
First seen:
2024-04-19 15:38:52 UTC
File Type:
Binary (Archive)
Extracted files:
723
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwqay7eqf7p3u3done6vc3bz4g5aj6xitq2o7ronubmqmajb3ioa._file
Verdict:
unknown
Similar samples:
58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
6630e9fa7f240408e4387ba3552e7cf1d1559c3ef00fc0e66fb6b2e83a68b2e6
6a94447715f2799d8b5fe10299fd93fe3d37c1bc89a6aaaa3781c689f0bc153b
867b5ce94a5737612bff3244d4334180382a439f0a8c8b4c59570c7fdf370929
b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/240419-vp9nxaac25/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Microsoft Software Installer (MSI) msi b5a00c7c902fdfba6c6e693d516c39e1ba04fae89c34efc5cda059060121da1c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments