rustybuer | 2b093ef5eef05f81d6b69c61951091a399ccf6dbc42df822c40f35146a04523c

Sharing

Copy URL

Twitter E-mail

General

Target

2b093ef5eef05f81d6b69c61951091a399ccf6dbc42df822c40f35146a04523c
Size

1.2MB
MD5

003b5373a5c5a4bdcef827a6ad335cc7
SHA1

2f535266344cc774d506fa517aab97d74d0ea76a
SHA256

2b093ef5eef05f81d6b69c61951091a399ccf6dbc42df822c40f35146a04523c
SHA512

ef3df7d2a5a9b8b2145e77ead4edb27db07d092d886f2ac3d94546974a96751f34fb940d4b1d88ccec4a443dbb4c3d5dd3ce4be68bb0394a16eb260fa4f91ab8
SSDEEP

24576:J37cW5jZ1FMIItpyjtfnMc0Na+VQn65wn9OkLulgVIH06iyNXx:N1men7fx4qu2IU6iUXx

Score

10^/10

rustybuer

Malware Config

Extracted

Family

rustybuer

https://cerionetya.com/

Signatures

Rustybuer family
rustybuer

Files

2b093ef5eef05f81d6b69c61951091a399ccf6dbc42df822c40f35146a04523c
.exe windows x86

e7ec82902667c85630fba388752f5a40

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtQueryDefaultLocale
RtlCaptureContext
RtlUnwind

kernel32

GetLastError
Process32Next
CloseHandle
GetCurrentProcess
SetLastError
GetModuleFileNameW
GetProcessHeap
HeapFree
CreateFileW
Sleep
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
HeapReAlloc
GetVolumePathNameW
GetDiskFreeSpaceW
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
Process32First
GetStdHandle
GetConsoleMode
WriteFile
WriteConsoleW
GetCurrentDirectoryW
GetCurrentThread
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
TlsAlloc
GetModuleHandleW
FormatMessageW
InitializeCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetHandleInformation
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateThread
CreateToolhelp32Snapshot
VirtualAlloc
GetSystemInfo
GetVolumeInformationA
GetEnvironmentVariableW
DecodePointer
SetFilePointerEx
LCMapStringW
CompareStringW
HeapSize
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetCommandLineW
GetConsoleCP
FlushFileBuffers
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleHandleExW
GetCommandLineA

advapi32

RegQueryValueExW
RegOpenKeyExW
GetUserNameW
GetTokenInformation
OpenProcessToken
GetCurrentHwProfileW
SystemFunction036

bcrypt

BCryptGenRandom

netapi32

NetWkstaGetInfo

user32

GetSystemMetrics

ws2_32

getsockname
accept
ioctlsocket
WSASend
send
WSARecv
recv
listen
WSASocketW
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
bind
gethostname
getpeername
select
connect
setsockopt
getsockopt
closesocket

Sections

.text
Size: 603KB - Virtual size: 603KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 580KB - Virtual size: 579KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

e7ec82902667c85630fba388752f5a40

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

bcrypt

netapi32

user32

ws2_32

Sections

.text Size: 603KB - Virtual size: 603KB

.rdata Size: 580KB - Virtual size: 579KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 603KB - Virtual size: 603KB

.rdata
Size: 580KB - Virtual size: 579KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 33KB - Virtual size: 33KB