industroyer | 9ec8468dd4a81b0b35c499b31e67375e[.]industroyer2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe
Size 624KB
Sample220426-xvvs2shfdl
SHA256 cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
MD5 9ec8468dd4a81b0b35c499b31e67375e
SHA1 6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA512 bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2
SSDEEP 12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

industroyer

Malware Config

Signatures

Industroyer 1 IoCs

Contains code associated with parsing industroyer's configuration file.

resource	yara_rule
sample	win_industroyer_w4

Industroyer family
industroyer

File Explorer

9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe

.exe 624KB

9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe

IMPHASH 469902c5413cba2b13d3e7d2e63a4cc9
SHA256 cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
MD5 9ec8468dd4a81b0b35c499b31e67375e
SHA1 6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA512 bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2
SSDEEP 12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+
MD5 SHA1 SHA512 SSDEEP

windows x86

Industroyer

Contains code associated with parsing industroyer's configuration file.

Minor OS version

Major OS version

Entry point

360516

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoTaskMemFree StringFromCLSID CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantInit SysFreeString

ws2_32

WSASetLastError getaddrinfo WSAStartup getservbyname getservbyport WSACleanup WSAGetLastError freeaddrinfo socket shutdown setsockopt sendto select recvfrom ntohs listen inet_addr htons htonl getsockname getpeername connect closesocket bind accept inet_ntoa gethostbyaddr gethostbyname

crypt32

CertFreeCertificateContext

secur32

DecryptMessage EncryptMessage FreeContextBuffer QueryCredentialsAttributesA QueryContextAttributesA ApplyControlToken DeleteSecurityContext InitializeSecurityContextA AcquireCredentialsHandleA

user32

PostThreadMessageA

kernel32

FreeEnvironmentStringsW GetOEMCP SetStdHandle HeapReAlloc GetTimeZoneInformation FlushFileBuffers HeapFree HeapAlloc LCMapStringW CompareStringW GetTimeFormatW GetProcessHeap GetCommandLineW GetCommandLineA GetStringTypeW DeleteFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW GetConsoleCP WriteFile ReadConsoleW GetConsoleMode GetDateFormatW SetEndOfFile GetFileType CreateDirectoryW GetCurrentDirectoryW SetEnvironmentVariableW GetDriveTypeW SetConsoleCtrlHandler GetModuleHandleExW LoadLibraryExW WriteConsoleW HeapSize MoveFileExW ExitProcess InterlockedIncrement InterlockedDecrement FreeLibrary GetProcAddress ReadFile SetFilePointerEx CloseHandle LoadLibraryA GetModuleHandleA CreateFileW SearchPathA LocalFree FlushInstructionCache VirtualProtectEx VirtualQueryEx GetCurrentProcess TerminateProcess GetThreadSelectorEntry GetLastError SetLastError ReadProcessMemory WriteProcessMemory GetThreadContext SetThreadContext SuspendThread ResumeThread WaitForDebugEvent ContinueDebugEvent DebugActiveProcess SetEvent WaitForSingleObject GetSystemInfo CreateEventA GetLogicalDriveStringsW GetSystemDirectoryA GetCurrentDirectoryA QueryDosDeviceW OpenProcess GetVersionExA GetCurrentProcessId FormatMessageA GetSystemTimeAsFileTime CompareFileTime DecodePointer IsDebuggerPresent Sleep FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency GetExitCodeProcess GetEnvironmentStringsW CreateThread GetCurrentThreadId TerminateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetStdHandle CreateSemaphoreA CreateProcessW SearchPathW GetFullPathNameW GetModuleFileNameW GetFileAttributesW MultiByteToWideChar IsValidCodePage GetACP GetCPInfo IsDBCSLeadByteEx WideCharToMultiByte FindClose UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW InitializeSListHead TlsFree RtlUnwind RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue