erbium | a54d4986e42a30f271bf1e70e9153b44[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
a54d4986e42a30f271bf1e70e9153b44.dll
Size 2.7MB
Sample221025-lbcbtacbcq
SHA256 1d58e9f81b10e3da48c2525020f25e6109f14026e1234041bf7131c5b8c0c8bd
MD5 a54d4986e42a30f271bf1e70e9153b44
SHA1 a7f8b572c7afd435690200115adf3b047486d3a6
SHA512 f5895ca7f359b18d9cee671dfc904cc1417d01b2abf0e67195397dabb0d463ed64b9a64edb299f000a54aad3e0139879859363bc3086a62101d09a7b58f51532
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYch2ek:P1Kqvv07noI7lOOYcz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

erbium

Malware Config

Extracted

Family

erbium

http://77.73.133.53/cloud/index.php

Signatures

Erbium family
erbium

File Explorer

a54d4986e42a30f271bf1e70e9153b44.dll

.dll 2.7MB

a54d4986e42a30f271bf1e70e9153b44.dll

IMPHASH c0d46b7ff0e53996feb53e4ba78f033e
SHA256 1d58e9f81b10e3da48c2525020f25e6109f14026e1234041bf7131c5b8c0c8bd
MD5 a54d4986e42a30f271bf1e70e9153b44
SHA1 a7f8b572c7afd435690200115adf3b047486d3a6
SHA512 f5895ca7f359b18d9cee671dfc904cc1417d01b2abf0e67195397dabb0d463ed64b9a64edb299f000a54aad3e0139879859363bc3086a62101d09a7b58f51532
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYch2ek:P1Kqvv07noI7lOOYcz
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

2216185

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter HeapSize GetPrivateProfileStringA K32GetModuleFileNameExA TerminateProcess OpenProcess Process32First FindFirstFileA DeviceIoControl FindNextFileA GetVolumeInformationA GetModuleHandleA CreateToolhelp32Snapshot GlobalSize GlobalAlloc HeapReAlloc GetNativeSystemInfo GlobalLock GlobalMemoryStatusEx GlobalUnlock VirtualProtect K32GetModuleInformation CreateThread HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI LoadLibraryA GetTickCount Sleep GetTempPathA Process32Next MultiByteToWideChar lstrcmpiW DeleteCriticalSection DecodePointer RaiseException GetLastError FlushFileBuffers WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx CopyFileW MoveFileExW GetFileInformationByHandleEx GetExitCodeThread QueryPerformanceFrequency GetStringTypeW LCMapStringEx EncodePointer GetModuleHandleW CompareStringEx GetCPInfo IsDebuggerPresent SetLastError SleepEx GetSystemDirectoryW GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleFileNameW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA InitializeCriticalSectionEx

user32

ReleaseDC GetDC EnumDisplayDevicesA GetSystemMetrics GetDesktopWindow

gdi32

StretchBlt SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetCurrentObject GetDIBits DeleteDC GetObjectW

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptGetHashParam CryptCreateHash RegQueryValueExA CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA GetUserNameA RegGetValueA RegCloseKey

shell32

ShellExecuteA

ole32

GetHGlobalFromStream CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CLSIDFromString

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptUnprotectData CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream

urlmon

URLDownloadToFileA

ws2_32

getsockopt htons getpeername setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockname ntohs

wldap32

ord167 ord301 ord147 ord133 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord216 ord14 ord46 ord219 ord145 ord79 ord142