r77 | f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb

Sharing

Copy URL Twitter E-mail

General

Target
f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb
Size 1.4MB
Sample220211-3afraafadl
SHA256 f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb
MD5 eeca82991588e81f727c0d36e62871e9
SHA1 5c7d62477d02a366ed882bb272cf46a21f9c3ce6
SHA512 3915574dde192d4b899843596d1fae081ffe6d17ad4efa51ef910e4148d03df7a8c44446bcd9a54579ef364cd6e8512197c5d6a9aeabc4d54a797cb67b71280c
SSDEEP 24576:lxY3CengBUw/JT/BYyVDSu4t7jM7PJSPsbJ7:lxYSegBUwF//+UJNV7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

File Explorer

f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb

.exe 1.4MB

f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb

IMPHASH 47675bdf62a48bce036313bb6efbbad3
SHA256 f14dab97f0213e6267b4e438b07b0006f13abf5d47c7b2e68fdcf8d5fedc19bb
MD5 eeca82991588e81f727c0d36e62871e9
SHA1 5c7d62477d02a366ed882bb272cf46a21f9c3ce6
SHA512 3915574dde192d4b899843596d1fae081ffe6d17ad4efa51ef910e4148d03df7a8c44446bcd9a54579ef364cd6e8512197c5d6a9aeabc4d54a797cb67b71280c
SSDEEP 24576:lxY3CengBUw/JT/BYyVDSu4t7jM7PJSPsbJ7:lxYSegBUwF//+UJNV7
MD5 SHA1 SHA512 SSDEEP

windows x64

r77 rootkit payload

Detects the payload of the r77 rootkit.

Minor OS version

Major OS version

Entry point

280840

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile GetProcAddress LoadLibraryA GetModuleHandleA MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceExW FindResourceW InitializeCriticalSectionEx RaiseException DecodePointer DeleteCriticalSection GetModuleHandleW GlobalAlloc GlobalLock GlobalUnlock FreeResource CreateFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesW GetCurrentProcess LoadLibraryW FreeLibrary IsWow64Process GetNativeSystemInfo GetSystemInfo SetLastError WaitForSingleObject ResumeThread GetPrivateProfileStringW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetTimeZoneInformation EnumSystemLocalesW HeapReAlloc IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetStdHandle GetModuleFileNameW ExitProcess CreateDirectoryW GetModuleHandleExW GetLastError CloseHandle Sleep GetProcessHeap HeapAlloc WritePrivateProfileStringW HeapFree FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID HeapDestroy FlsFree FlsSetValue IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection WideCharToMultiByte GetStringTypeW WaitForSingleObjectEx GetCurrentThreadId EncodePointer LCMapStringEx QueryPerformanceCounter GetLocaleInfoEx FlsAlloc FlsGetValue

user32

TranslateMessage DispatchMessageW PostMessageW GetMessageW TranslateAcceleratorW LoadCursorW CreateWindowExW SendMessageW MessageBoxW MessageBoxA SystemParametersInfoW LoadIconW RegisterClassExW GetSystemMetrics SetWindowLongPtrW ShowWindow UpdateWindow GetDC GetWindowRect UpdateLayeredWindow ReleaseDC GetWindowLongPtrW DefWindowProcW SetLayeredWindowAttributes BeginPaint EndPaint PostQuitMessage SetTimer SetCursor KillTimer ReleaseCapture MoveWindow LoadAcceleratorsW

gdi32

DeleteDC SelectObject CreateDIBSection CreateCompatibleDC DeleteObject CreateFontIndirectW

shell32

SHGetFolderPathW

ole32

CreateStreamOnHGlobal

gdiplus

GdipFree GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipGetImageWidth GdipGetImageHeight GdipCreateTexture GdipCreateTextureIAI GdipSetTextureWrapMode GdipTranslateTextureTransform GdipFillRectangleI GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCloneImage GdipDeleteBrush GdipGetTextureImage GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateSolidFill GdipCloneStringFormat GdipStringFormatGetGenericTypographic GdipSetStringFormatFlags GdipDeleteFont GdipSetSolidFillColor GdipMeasureString GdipCreateFromHDC GdipDeleteGraphics GdipSetStringFormatAlign GdipAlloc GdipDisposeImage GdipCloneBrush GdipCreateImageAttributes GdipDrawString

winmm

PlaySoundW mciSendStringW

comctl32

InitCommonControlsEx _TrackMouseEvent

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

442KB

Virtual Size

442KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ