industroyer | 7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad

General

Target
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad
Size 133KB
Sample220128-r96afafacj
SHA256 7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad
MD5 a193184e61e34e2bc36289deaafdec37
SHA1 94488f214b165512d2fc0438a581f5c9e3bd4d4c
SHA512 113bccfa08798158cb8bc31eadfc0d4e91645422cadda7cc2ece753ad5a51c7260a7ff11aae25d7802965979aa996ef6428d5eb9882532a4f55518d2107b136f
SSDEEP 3072:McaprOfoaXmgD31r4VWBvRZoiTprUZNZ9VQ6s6W9:McuOJ2gD31QW51pgE6st9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

industroyer

Malware Config

Signatures

Industroyer 1 IoCs

Contains code associated with parsing industroyer's configuration file.

resource	yara_rule
sample	win_industroyer_w4

Industroyer IEC-104 Module 1 IoCs

Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.

resource	yara_rule
sample	win_industroyer_w3

Industroyer family
industroyer

File Explorer

7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad

.dll 133KB

7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad

IMPHASH f3fa7eda5f4e7d94a714ad0e0880245e
SHA256 7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad
MD5 a193184e61e34e2bc36289deaafdec37
SHA1 94488f214b165512d2fc0438a581f5c9e3bd4d4c
SHA512 113bccfa08798158cb8bc31eadfc0d4e91645422cadda7cc2ece753ad5a51c7260a7ff11aae25d7802965979aa996ef6428d5eb9882532a4f55518d2107b136f
SSDEEP 3072:McaprOfoaXmgD31r4VWBvRZoiTprUZNZ9VQ6s6W9:McuOJ2gD31QW51pgE6st9
MD5 SHA1 SHA512 SSDEEP

windows x86

Industroyer

Contains code associated with parsing industroyer's configuration file.
Industroyer IEC-104 Module

Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.

Minor OS version

Major OS version

Entry point

22104

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32First SetConsoleTextAttribute GetStdHandle TerminateProcess WaitForMultipleObjects SetThreadPriority OpenProcess CreateToolhelp32Snapshot Sleep Process32Next CloseHandle CreateThread ReadConsoleW ReadFile SetEndOfFile HeapReAlloc HeapSize WriteConsoleW SetFilePointerEx SetStdHandle FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException InterlockedFlushSList GetLastError SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc LCMapStringW GetFileType GetACP WriteFile GetConsoleCP GetConsoleMode GetStringTypeW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateFileW DecodePointer

ws2_32

closesocket getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError

Sharing