egregor | 0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952

General

Target
0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952
Size 693KB
Sample220201-kb7maabdhm
SHA256 0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952
MD5 b7ad5f7ec71dc812b4771950671b192a
SHA1 cf02d630465eaf009db8bcc8a0dd4242a1d2dd82
SHA512 5dd1d8e840b56f35cc06dd826aa335fec131ad202ccbb572c88b4dd4b630a291453df7c0fbfee2229ea7f4d2810a73a752ca8657c505f383974736a5f1f75369
SSDEEP 12288:XEcAC948owAoT9eEoz6bN8Y1pZZ7Ll2oeP2HQ7q/jV4:01Ch+vOZ7h2om57q/p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

egregor

Malware Config

Signatures

Detected Egregor ransomware 1 IoCs

resource	yara_rule
sample	family_egregor

Egregor family
egregor

File Explorer

0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952

.dll 693KB

0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952

IMPHASH 505285b5c7f1918326c961aae0b20a69
SHA256 0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952
MD5 b7ad5f7ec71dc812b4771950671b192a
SHA1 cf02d630465eaf009db8bcc8a0dd4242a1d2dd82
SHA512 5dd1d8e840b56f35cc06dd826aa335fec131ad202ccbb572c88b4dd4b630a291453df7c0fbfee2229ea7f4d2810a73a752ca8657c505f383974736a5f1f75369
SSDEEP 12288:XEcAC948owAoT9eEoz6bN8Y1pZZ7Ll2oeP2HQ7q/jV4:01Ch+vOZ7h2om57q/p
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Detected Egregor ransomware

Minor OS version

Major OS version

Entry point

5216

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc Sleep GetProcAddress LoadLibraryW CreateFileW VirtualQuery VirtualFree VirtualProtect GetCurrentProcess FlushInstructionCache LoadLibraryA IsBadReadPtr FreeLibrary lstrcmpA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess InterlockedPushEntrySList InterlockedFlushSList RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap GetStdHandle GetFileType SetConsoleCtrlHandler GetStringTypeW HeapSize HeapReAlloc SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringA OutputDebugStringW CloseHandle WaitForSingleObjectEx CreateThread WriteConsoleW EncodePointer DecodePointer

Name

.text

Size

399KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

231KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952

kernel32