r77 | Dragon Ball Z Kakarot v1[.]03-v1[.]60 Plus 32 Trainer[.]exe

Resubmissions

10/02/2023, 16:09

230210-tl8rrshf9210

10/02/2023, 16:01

230210-tgqqdshd5710

Sharing

Copy URL Twitter E-mail

General

Target
Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe
Size 1.3MB
Sample230210-tgqqdshd57
SHA256 a9ac519ca396e0878eb15b11d7c697bc175f380b00162f4cb351239353747d3a
MD5 5976447d2d9d6aca7e3df4bc0d27bfe7
SHA1 0a137d372e3123713f7c690fa2831de162ae69c8
SHA512 6eca409e1053b23f3affc9d2d7f562ddae0c60de55183ae82b1098c896f7d1b48fa12ed39c96b0f4ca8a06ddd7aae22dbd2003b2389793a702d32528afeefa87
SSDEEP 24576:NkwWyiqAVWAvGNYn3rJ4FJXFtspAyji8GbJ7NDSIWC1:LuVuOnN4oALFV7bWC1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

File Explorer

Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe

.exe 1.3MB

Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe

IMPHASH cf68394e6217c2041e6113c35a9269c6
SHA256 a9ac519ca396e0878eb15b11d7c697bc175f380b00162f4cb351239353747d3a
MD5 5976447d2d9d6aca7e3df4bc0d27bfe7
SHA1 0a137d372e3123713f7c690fa2831de162ae69c8
SHA512 6eca409e1053b23f3affc9d2d7f562ddae0c60de55183ae82b1098c896f7d1b48fa12ed39c96b0f4ca8a06ddd7aae22dbd2003b2389793a702d32528afeefa87
SSDEEP 24576:NkwWyiqAVWAvGNYn3rJ4FJXFtspAyji8GbJ7NDSIWC1:LuVuOnN4oALFV7bWC1
MD5 SHA1 SHA512 SSDEEP

windows x64

r77 rootkit payload

Detects the payload of the r77 rootkit.

Minor OS version

Major OS version

Entry point

188584

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress WaitNamedPipeW GetLastError CreateFileW ReadFile WriteFile GetModuleHandleA LoadLibraryA GetPrivateProfileStringW WritePrivateProfileStringW GetModuleHandleW FindResourceW LoadResource SizeofResource LockResource GetFileAttributesW GetModuleFileNameW LoadLibraryExW FreeLibrary MultiByteToWideChar GetCurrentProcess IsWow64Process SetLastError ResumeThread WaitForSingleObject GetTempPathW CreateDirectoryW WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetStdHandle GetFullPathNameW GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LocalFree WideCharToMultiByte GetStringTypeW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader RaiseException GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW ExitThread GetStdHandle HeapFree HeapAlloc SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode

user32

MessageBoxA MessageBoxW

shell32

SHGetFolderPathW

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy

mscoree

CorBindToRuntime CLRCreateInstance

wininet

InternetReadFile InternetOpenUrlA InternetOpenA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW