r77 | ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd

Sharing

Copy URL Twitter E-mail

General

Target
ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd
Size 3.1MB
Sample221001-1c92sshfhn
SHA256 ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd
MD5 5f765eee8482e0aa6d22dbd636e743d7
SHA1 29b17065b28763c7b464bc30077ffc9441feae45
SHA512 41d3c379c444cb0d0f7189585cb927090c02035c1c6f20ee6da0864130ba1d675a273c49c00d9d353d78ee435b368d52225170e55d998953b3f1142aa4164f28
SSDEEP 49152:mBEhaAKIT0yjox5za99WrhPCqN69x526qvsPIdCV7LGDOvhAyGWv4uAcZ6e7ur3:3365za99W5k9/zwCVdNG020W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

File Explorer

ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd

.exe 3.1MB

ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd

IMPHASH 16eaad45843d270eff2d544c94722086
SHA256 ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd
MD5 5f765eee8482e0aa6d22dbd636e743d7
SHA1 29b17065b28763c7b464bc30077ffc9441feae45
SHA512 41d3c379c444cb0d0f7189585cb927090c02035c1c6f20ee6da0864130ba1d675a273c49c00d9d353d78ee435b368d52225170e55d998953b3f1142aa4164f28
SSDEEP 49152:mBEhaAKIT0yjox5za99WrhPCqN69x526qvsPIdCV7LGDOvhAyGWv4uAcZ6e7ur3:3365za99W5k9/zwCVdNG020W
MD5 SHA1 SHA512 SSDEEP

windows x86

r77 rootkit payload

Detects the payload of the r77 rootkit.

Minor OS version

Major OS version

Entry point

595316

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamProperty midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart

ws2_32

recvfrom recv ioctlsocket send inet_ntoa WSAStartup WSACleanup select accept getpeername closesocket WSAAsyncSelect

rasapi32

RasGetConnectStatusA RasHangUpA

kernel32

Process32First CreateToolhelp32Snapshot SetFilePointer GetFileSize GetCurrentProcess TerminateProcess OpenProcess GetWindowsDirectoryA GetSystemDirectoryA SetLastError GetTimeZoneInformation GetVersion FileTimeToSystemTime InterlockedIncrement InterlockedDecrement GetSystemInfo IsProcessorFeaturePresent lstrcmpiA GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA InterlockedExchange IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetFileType SetStdHandle GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime LocalFree GetFileAttributesA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle FindClose FindFirstFileA GetTempPathA GlobalUnlock GlobalLock GlobalAlloc Sleep CreateEventA CreateThread WritePrivateProfileStringA GetVersionExA GetLastError LoadLibraryA FreeLibrary GetFullPathNameA WideCharToMultiByte MultiByteToWideChar GetUserDefaultLCID HeapAlloc Process32Next CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap

user32

wsprintfA WaitForInputIdle InflateRect CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSysColorBrush SetWindowTextA GetForegroundWindow EnumWindows GetWindowTextA GetDlgItem FindWindowA GetWindowThreadProcessId GetClassNameA GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID LoadStringA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect UnregisterClassA IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime

gdi32

ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape SaveDC GetTextMetricsA RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo GetPolyFillMode SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegQueryValueA RegOpenKeyA RegCreateKeyExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi SafeArrayGetUBound VariantChangeType VariantClear VariantCopy UnRegisterTypeLi

comctl32

ord17 ImageList_Destroy

wininet

InternetCloseHandle

comdlg32

ChooseColorA GetOpenFileNameA GetSaveFileNameA GetFileTitleA