industroyer | 44ba5f629c731604580c863afa7e84c87e0ebf431294fa4646c83f8820d2ffa5 | Triage

Sharing

General

Target

44ba5f629c731604580c863afa7e84c87e0ebf431294fa4646c83f8820d2ffa5
Size

480KB
MD5

46ff7a914be72003199e051cab2b2c0d
SHA1

6b1785ae3d2415cd12eedbe4d232a2887d5aa7fb
SHA256

44ba5f629c731604580c863afa7e84c87e0ebf431294fa4646c83f8820d2ffa5
SHA512

3c7ce281805ded31fbdd74f66f8daefb534e7b87d03014580446416c962651fa292b44c75518841eb478b90656f8242f1f01c3779f164e38f87c11d692029fea
SSDEEP

1536:ipIv8wiD3kkZZpgq8QK8mfkCwbqidQY1sWfScdAUeMfh9UQ:kwPQ6MbjF3TAUeMZ9J

Score

10^/10

industroyer

Malware Config

Signatures

Industroyer Wiper Module 2 IoCs

Registry wiper functionality assoicated with Industroyer.

Processes:

resource	yara_rule
sample	win_industroyer_w7
sample	win_industroyer_w8

Industroyer family
industroyer

Files

44ba5f629c731604580c863afa7e84c87e0ebf431294fa4646c83f8820d2ffa5
.dll windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ