Static task
static1
Behavioral task
behavioral1
Sample
SATURN_RANSOM.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SATURN_RANSOM.exe
Resource
win10v2004-20220414-en
General
-
Target
SATURN_RANSOM.bin
-
Size
338KB
-
MD5
bbd4c2d2c72648c8f871b36261be23fd
-
SHA1
77c525e6b8a5760823ad6036e60b3fa244db8e42
-
SHA256
9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021
-
SHA512
38f2ff3b7ff6faa63ef0a3200e0dbb9e48e1d404a065f6919cb6d245699479896a42316f299c33c8cc068922934c64f8aa06c88b000d1676870c1d0c0f18e14a
-
SSDEEP
6144:zUrigyvF8Q9fLglQ8t0qabFDfOdQ/LDA8H+wwaMZUUAOq+mwNf8fsS+:zUrigY8QBLg9t0qabFDGdQ/TlYiUQ+Vz
Malware Config
Signatures
Files
-
SATURN_RANSOM.bin.exe windows x86
fc7c70bdf521087654ea0c66669225c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetCurrentProcess
InitializeCriticalSectionEx
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
HeapSize
DeleteFileA
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetComputerNameA
CreateProcessA
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
GetLogicalDriveStringsA
SetFileAttributesA
MoveFileExA
lstrlenA
GetDriveTypeA
MoveFileA
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
GetFileSize
CreateFileA
GetLastError
MultiByteToWideChar
WriteFile
lstrlenW
ReadFile
LocalFree
CloseHandle
GetFileAttributesA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
GetModuleHandleA
LocalAlloc
GetProcessHeap
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
RtlUnwind
FreeLibrary
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetACP
SetStdHandle
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetCurrentDirectoryW
GetFullPathNameW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExW
SetEndOfFile
user32
SystemParametersInfoA
advapi32
CryptDestroyKey
RegQueryValueExA
RegCloseKey
CryptReleaseContext
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegCreateKeyExA
OpenProcessToken
SetSecurityInfo
GetTokenInformation
CryptGenRandom
RegOpenKeyExA
CryptAcquireContextA
CryptAcquireContextW
CryptEncrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
shell32
SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA
ole32
CoCreateInstance
CoInitialize
crypt32
CryptStringToBinaryA
CryptImportPublicKeyInfo
CryptDecodeObjectEx
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ