Static task
static1
Behavioral task
behavioral1
Sample
d02798629a25f74b9a5340cd3a5b1070cecbdffe04332c76c20f31357440b5fd.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d02798629a25f74b9a5340cd3a5b1070cecbdffe04332c76c20f31357440b5fd.dll
Resource
win10v2004-en-20220113
General
-
Target
d02798629a25f74b9a5340cd3a5b1070cecbdffe04332c76c20f31357440b5fd
-
Size
156KB
-
MD5
f1bd39b9c385e63a373e4cfcf569cd53
-
SHA1
8cfc211e04f866450637a6f4c124eb44be86e86e
-
SHA256
d02798629a25f74b9a5340cd3a5b1070cecbdffe04332c76c20f31357440b5fd
-
SHA512
0c99c62bf1f35e6a2eefbcc476bcc705e5370fcc4ceb32b6aa827a993c683443b602201e85d30440abea56bbf2f193c57b58f9f89de12f4fe429a6d213a7a65d
-
SSDEEP
3072:McaprOfoaXmgD31r4VWBvRZoiTpUUZNZ9Vs7Is6W9:McuOJ2gD31QW51pHwUst9
Malware Config
Signatures
-
Industroyer 1 IoCs
Contains code associated with parsing industroyer's configuration file.
Processes:
resource yara_rule sample win_industroyer_w4 -
Industroyer IEC-104 Module 1 IoCs
Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.
Processes:
resource yara_rule sample win_industroyer_w3 -
Industroyer family
Files
-
d02798629a25f74b9a5340cd3a5b1070cecbdffe04332c76c20f31357440b5fd.dll windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ