industroyer | 018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81

General

Target
018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81
Size 74KB
Sample220128-tbxlragbbk
SHA256 018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81
MD5 ab17f2b17c57b731cb930243589ab0cf
SHA1 5a5fafbc3fec8d36fd57b075ebf34119ba3bff04
SHA512 62aac7869c47f89a545eadb2a150181771e1accfe454673d81e3899447e907aae030beea31cfc66820f665fa5060190a6c8823dd6356fbe34af99eae7e4067ce
SSDEEP 1536:ipIv8wiD3kkZZpgq8QK8mfkCwbq4QY1sWfScdAUehZfh9UQ:kwPQ6MbtF3TAUehZZ9J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

industroyer

Malware Config

Signatures

Industroyer Wiper Module 3 IoCs

Suspicious strings and export indicative of Industroyer wiper module.

resource	yara_rule
sample	win_industroyer_w1
sample	win_industroyer_w7
sample	win_industroyer_w8

Industroyer family
industroyer

File Explorer

018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81

.dll 74KB

018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81

IMPHASH b8470876110398fe8a8bfd33da62324a
SHA256 018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81
MD5 ab17f2b17c57b731cb930243589ab0cf
SHA1 5a5fafbc3fec8d36fd57b075ebf34119ba3bff04
SHA512 62aac7869c47f89a545eadb2a150181771e1accfe454673d81e3899447e907aae030beea31cfc66820f665fa5060190a6c8823dd6356fbe34af99eae7e4067ce
SSDEEP 1536:ipIv8wiD3kkZZpgq8QK8mfkCwbq4QY1sWfScdAUehZfh9UQ:kwPQ6MbtF3TAUehZZ9J
MD5 SHA1 SHA512 SSDEEP

windows x86

Industroyer Wiper Module

Suspicious strings and export indicative of Industroyer wiper module.

Minor OS version

Major OS version

Entry point

6817

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForMultipleObjects FindClose CreateFileW ExitThread OpenProcess CreateToolhelp32Snapshot Process32NextW TerminateProcess CloseHandle CreateThread GetFileSize GetCurrentProcessId SetUnhandledExceptionFilter DecodePointer WriteFile lstrlenW FindNextFileW Process32FirstW FindFirstFileW WriteConsoleW SetFilePointerEx UnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc LCMapStringW FindFirstFileExA FindNextFileA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode RaiseException

user32

wsprintfW

advapi32

RegEnumKeyW RegSetValueExW RegOpenKeyExW RegCloseKey

shlwapi

PathCombineW StrCmpW

psapi

EnumProcesses

Sharing