erbium | b26bbe590caac12efcf76a1d62b390aa[.]dll

Resubmissions

22-09-2022 16:57

220922-vga6dabhg7 10

22-09-2022 16:56

220922-vf4rasfgaq 10

22-09-2022 16:48

220922-va6cyabhf9 8

13-09-2022 17:49

220913-wd1sascabl 8

Sharing

Copy URL

Twitter E-mail

General

Target

b26bbe590caac12efcf76a1d62b390aa.dll
Size

2.7MB
MD5

b26bbe590caac12efcf76a1d62b390aa
SHA1

8027ce80904f287ee72ceee68a0ec95dddf309ac
SHA256

4ea86098be9e4fd932758729fbe6c7fd4c53babf228388b24f8b263ebccf56f4
SHA512

f5ac91af8fb36d990082ccab8f2ba130ac2cdfd1c3d29e6dd26be4ae59346fde3c98eb1c08c80f7e44b22ac33f5ab60ef8216fb54dfe0eb8e8245297e7f9f774
SSDEEP

49152:94j4pRhvvWPcqysG2ZLyZMCWH+DGeQwa:CjcvWPcqZHcZMCWH+Kt3

Score

10^/10

erbium

Malware Config

Extracted

Family

erbium

http://ozaron.beget.tech/cloud/

Signatures

Erbium family
erbium

Files

b26bbe590caac12efcf76a1d62b390aa.dll
.dll windows x86

c0d46b7ff0e53996feb53e4ba78f033e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
HeapSize
GetPrivateProfileStringA
K32GetModuleFileNameExA
TerminateProcess
OpenProcess
Process32First
FindFirstFileA
DeviceIoControl
FindNextFileA
GetVolumeInformationA
GetModuleHandleA
CreateToolhelp32Snapshot
GlobalSize
GlobalAlloc
HeapReAlloc
GetNativeSystemInfo
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
VirtualProtect
K32GetModuleInformation
CreateThread
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
LoadLibraryA
GetTickCount
Sleep
GetTempPathA
Process32Next
MultiByteToWideChar
lstrcmpiW
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetFileInformationByHandle
SetFilePointerEx
CopyFileW
MoveFileExW
GetFileInformationByHandleEx
GetExitCodeThread
QueryPerformanceFrequency
GetStringTypeW
LCMapStringEx
EncodePointer
GetModuleHandleW
CompareStringEx
GetCPInfo
IsDebuggerPresent
SetLastError
SleepEx
GetSystemDirectoryW
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleFileNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
InitializeCriticalSectionEx

user32

ReleaseDC
GetDC
EnumDisplayDevicesA
GetSystemMetrics
GetDesktopWindow

gdi32

StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetCurrentObject
GetDIBits
DeleteDC
GetObjectW

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptGetHashParam
CryptCreateHash
RegQueryValueExA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
GetUserNameA
RegGetValueA
RegCloseKey

shell32

ShellExecuteA

ole32

GetHGlobalFromStream
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CLSIDFromString

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CryptUnprotectData
CertOpenStore
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSaveImageToStream

urlmon

URLDownloadToFileA

ws2_32

getsockopt
htons
getpeername
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
connect
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockname
ntohs

wldap32

ord167
ord301
ord147
ord133
ord127
ord27
ord26
ord117
ord41
ord208
ord73
ord216
ord14
ord46
ord219
ord145
ord79
ord142

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

c0d46b7ff0e53996feb53e4ba78f033e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

crypt32

iphlpapi

gdiplus

urlmon

ws2_32

wldap32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 316KB - Virtual size: 316KB

.data Size: 27KB - Virtual size: 38KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 88KB - Virtual size: 87KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 316KB - Virtual size: 316KB

.data
Size: 27KB - Virtual size: 38KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 88KB - Virtual size: 87KB