egregor | e719bfe408202e21f3542044bb4bb547[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e719bfe408202e21f3542044bb4bb547.exe
Size

882KB
MD5

e719bfe408202e21f3542044bb4bb547
SHA1

d1579d940d6f16035fd4f082b253faa2a579c009
SHA256

a11ac8d263cad1c1bf6b40bd22c71403027d9b7a7cd825055be91ba5e4bc9594
SHA512

214295e9b1a5235e890f658d5cdbe7d899fae0745a18b03df5c9c90194ea1a5f9a6a7375e24e37c8c5721c8afdcf559d8bf98a7f16bdeff0387df70f9885888e
SSDEEP

12288:VS7+t/QUMU7BWHI75Oe9Ub9+lZyxxnw4PwgOC0yxJJgR97J30uyXoHRocqPlafdQ:VS76/Qa7BWHI7O/xJJgzJ3qKl

Score

10^/10

egregor

Malware Config

Signatures

Detected Egregor ransomware 1 IoCs

Processes:

resource yara_rule

sample family_egregor
Egregor family
egregor

resource	yara_rule
sample	family_egregor

Files

e719bfe408202e21f3542044bb4bb547.exe
.exe windows x86

08a024e881cfeb4e54ac3c8a2ca94678

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-localization-l1-2-0

GetCPInfo
GetUserDefaultLCID
LCMapStringEx
IsValidLocale
GetLocaleInfoW
GetLocaleInfoEx
EnumSystemLocalesW
GetACP
FormatMessageA
LCMapStringW
GetOEMCP
IsValidCodePage

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte
CompareStringEx
GetStringTypeW

user32

GetForegroundWindow
MessageBoxA
PostMessageA
PostMessageW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
FreeEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCommandLineA
SetStdHandle

api-ms-win-core-file-l1-1-0

FindFirstFileExW
FindNextFileW
SetFilePointerEx
FindClose
CreateFileW
ReadFile
WriteFile
FlushFileBuffers
GetFileSizeEx
GetFileType

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapSize
HeapReAlloc
GetProcessHeap

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
ReadConsoleW
SetConsoleCtrlHandler

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Sections

.textbss
Size: - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 630KB - Virtual size: 630KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08a024e881cfeb4e54ac3c8a2ca94678

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

user32

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

Sections

.textbss Size: - Virtual size: 279KB

.text Size: 630KB - Virtual size: 630KB

.rdata Size: 102KB - Virtual size: 101KB

.data Size: 120KB - Virtual size: 126KB

.idata Size: 6KB - Virtual size: 6KB

.00cfg Size: 512B - Virtual size: 270B

.reloc Size: 21KB - Virtual size: 21KB

.textbss
Size: - Virtual size: 279KB

.text
Size: 630KB - Virtual size: 630KB

.rdata
Size: 102KB - Virtual size: 101KB

.data
Size: 120KB - Virtual size: 126KB

.idata
Size: 6KB - Virtual size: 6KB

.00cfg
Size: 512B - Virtual size: 270B

.reloc
Size: 21KB - Virtual size: 21KB