clop | 15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649[.]bin

Resubmissions

02-06-2022 16:53

220602-vd71yaghc4 10

06-05-2022 13:14

220506-qgs9qscfbj 1

16-03-2021 22:53

210316-ppl33lmc9a 1

Sharing

Copy URL

Twitter E-mail

General

Target

15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649.bin
Size

226KB
MD5

abdf498691f2b028bae0fa4276edc04b
SHA1

fb81951ebcd5cb111633bf4b6f78a18c522f37b9
SHA256

15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649
SHA512

f686453e61145f5cc21ead7dce23ad92dfa48cd8c3212828db13a52eaabdbd09beec5c7e481f8541498096a84cb79cf98ce9f0c18a246a10e60094de687c8af7
SSDEEP

3072:sJMMvli3RbBMCa9juwoxEEaEBhuVkywCl+zvrpAHm+CQZFKKKImBNCsSfoNyYs21:siyli31NaR2xBr19WsSgNyu9HGa

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Detects Clop Payload 1 IoCs

resource	yara_rule
sample	family_clop

Files

15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649.bin
.exe windows x86

50c2be0c7d9189886914438170ef3af7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
SetEndOfFile
GetLocalTime
SystemTimeToFileTime
FormatMessageW
lstrcmpiW
lstrcpynA
lstrcpynW
lstrlenA
TlsAlloc
TlsGetValue
TlsSetValue
CreateMutexA
OpenMutexA
CreateEventA
CreateEventW
CreateFileMappingA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
GetEnvironmentVariableA
SetEnvironmentVariableA
ExpandEnvironmentStringsA
FindResourceA
GetProfileStringW
GetDriveTypeW
GetCurrentDirectoryA
GetFullPathNameA
CreateFileA
GetFileAttributesW
DeleteFileW
FindFirstFileA
GetComputerNameA
GetACP
LCMapStringA
LCMapStringW
GetDateFormatA
IsValidLocale
GetStringTypeW
GetConsoleMode
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LockResource
FindResourceW
SetStdHandle
WriteConsoleW
SetFilePointerEx
GetConsoleCP
ReadConsoleW
HeapSize
GetEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetModuleHandleExW
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryExW
FreeLibrary
TlsFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetVersionExW
GetProcAddress
InterlockedExchange
SetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcess
GetStdHandle
GetFileType
GetFileInformationByHandle
SetHandleCount
SizeofResource
LoadResource
Sleep
WaitForMultipleObjects
SetEvent
DecodePointer
InitializeCriticalSectionAndSpinCount
QueueUserAPC
GetOverlappedResult
TerminateThread
GetCurrentThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
FreeEnvironmentStringsW
TerminateProcess
ExitProcess
OpenProcess
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
LocalFree
LocalReAlloc
GlobalMemoryStatus
GlobalCompact
FindNextFileW
FindFirstFileW
SetFileAttributesW
CreateFileW
CreateFileMappingW
lstrlenW
lstrcatW
lstrcpyW
lstrcpyA
lstrcmpW
UnmapViewOfFile
MapViewOfFile
GetTickCount
CloseHandle
FindClose
SetFilePointer
ReadFile
WriteFile
WaitForSingleObject
SetErrorMode
GetLastError
ExitThread
CreateThread
VirtualFree
VirtualAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc

user32

GetDesktopWindow
SetProcessDefaultLayout
GetProcessDefaultLayout
SetWindowLongA
GetWindowLongW
InflateRect
DrawFocusRect
GetSysColorBrush
ChildWindowFromPoint
ClientToScreen
HideCaret
MessageBeep
MessageBoxA
GetParent
SetWindowTextW
EndPaint
LoadCursorW
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
DrawTextExW
DrawTextW
LoadCursorA
FindWindowA
LoadIconA
LoadIconW
LoadStringW
SetWinEventHook
GetWindowThreadProcessId
CheckMenuRadioItem
GetClientRect
DrawTextA
TrackPopupMenuEx
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SendMessageW
PostMessageA
PostMessageW
wsprintfW
CharUpperW
GetKeyboardLayout
RegisterWindowMessageA
DefWindowProcA
UnhookWinEvent
DispatchMessageW
TranslateMessage
GetMessageA
BeginPaint
ReleaseDC
AppendMenuA
GetMenuItemCount
CheckMenuItem
SetMenu
LoadMenuW
TranslateAcceleratorA
LoadAcceleratorsW
LoadAcceleratorsA
KillTimer
SetTimer
ReleaseCapture
GetFocus
CharNextW
CharNextA
CharLowerW
CharUpperBuffW
GetClipboardData
CloseClipboard
GetDlgCtrlID
SendDlgItemMessageW
SendDlgItemMessageA
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
SetDlgItemTextA
SetDlgItemInt
DialogBoxIndirectParamA
DialogBoxParamW
DialogBoxParamA
IsZoomed
IsIconic
GetWindowPlacement
SetWindowPos
MoveWindow
ShowWindow
CreateWindowExW
RegisterClassA
CallWindowProcW
RegisterWindowMessageW

gdi32

CreateFontA
DeleteDC
GetDeviceCaps
GetTextExtentPoint32A
GetTextExtentPoint32W
SetBkMode
StretchBlt
SetTextColor
CreateFontIndirectW
GetTextMetricsW
StartDocA
EndDoc
SetAbortProc
GetObjectA
ExtTextOutA
LPtoDP
GetTextFaceW
CreateDCW
CreateCompatibleDC
GetTextMetricsA
CreateCompatibleBitmap

winspool.drv

GetPrinterDriverW
OpenPrinterW
GetPrinterA

comdlg32

GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
FindTextW
ReplaceTextW
ChooseFontA
ChooseFontW
PrintDlgA
PrintDlgExW
CommDlgExtendedError
PageSetupDlgW
GetOpenFileNameA

advapi32

CreateProcessAsUserW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceA
CreateServiceA
CloseServiceHandle
CryptAcquireContextW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyW
RegCreateKeyA
DuplicateTokenEx
CryptEncrypt
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RevertToSelf

shell32

Shell_NotifyIconA

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

shlwapi

PathFindFileNameW
StrStrW

crypt32

CryptImportPublicKeyInfo
CryptDecodeObjectEx
CryptStringToBinaryA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSQueryUserToken

rstrtmgr

RmStartSession
RmGetList
RmShutdown
RmEndSession
RmRegisterResources
RmRestart

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

50c2be0c7d9189886914438170ef3af7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

mpr

shlwapi

crypt32

userenv

wtsapi32

rstrtmgr

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 3KB - Virtual size: 9KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 3KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 17KB - Virtual size: 16KB