royal | avi[.]exe | Triage™

Resubmissions

09/03/2023, 23:09

230309-244jrsaf7910

09/03/2023, 23:06

230309-23pdfscd4v10

12/10/2022, 19:46

221012-ygzqhsaabj9

Sharing

Copy URL Twitter E-mail

General

Target
avi.exe
Size 2.9MB
Sample230309-23pdfscd4v
SHA256 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
MD5 df0b88dafe7a65295f99e69a67db9e1b
SHA1 db3163a09eb33ff4370ad162a05f4b2584a20456
SHA512 2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
SSDEEP 49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware royal

Malware Config

Signatures

Royal Ransomware 1 IoCs

ransomware

resource	yara_rule
sample	family_royal

Royal family
royal

File Explorer

avi.exe

.exe 2.9MB

avi.exe

IMPHASH 150bdf1f53f6260c91ec3fcff5867019
SHA256 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
MD5 df0b88dafe7a65295f99e69a67db9e1b
SHA1 db3163a09eb33ff4370ad162a05f4b2584a20456
SHA512 2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
SSDEEP 49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3
MD5 SHA1 SHA512 SSDEEP

windows x64

Royal Ransomware

ransomware

Minor OS version

Major OS version

Entry point

1976800

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetQueuedCompletionStatus CreateIoCompletionPort SleepConditionVariableCS ReadFile GetFileSizeEx GetCurrentProcess WakeAllConditionVariable GetProcessId SetEndOfFile CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW GetNativeSystemInfo SetFilePointerEx MoveFileExW FlushFileBuffers RtlVirtualUnwind SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA FormatMessageA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualFree GetEnvironmentVariableW MultiByteToWideChar GetACP GetStdHandle CancelIo GetModuleHandleW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize GetTimeZoneInformation GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW lstrcmpW WideCharToMultiByte CreateProcessW ExitProcess DeleteCriticalSection WaitForSingleObject lstrlenA InitializeConditionVariable InitializeCriticalSection WaitForMultipleObjects lstrlenW GetCommandLineW lstrcmpiW CreateThread CloseHandle Sleep GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetFullPathNameW GetCurrentDirectoryW SetStdHandle GetConsoleOutputCP GetOEMCP IsValidCodePage GetStringTypeW GetCPInfo HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc HeapFree GetModuleFileNameW SetConsoleCtrlHandler GetModuleHandleExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW LoadLibraryExW InitializeCriticalSectionAndSpinCount ExitThread CreateFileW FindClose LeaveCriticalSection WriteFile FindNextFileW EnterCriticalSection FindFirstFileW GetFileType GetLogicalDrives EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter

user32

wsprintfW GetProcessWindowStation MessageBoxW GetUserObjectInformationW

advapi32

DeregisterEventSource CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash ReportEventW RegisterEventSourceW CryptAcquireContextW CryptEnumProvidersW CryptSignHashW

shell32

CommandLineToArgvW

shlwapi

StrStrIW

ws2_32

WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa send WSAGetLastError WSAStartup gethostbyname ntohs getsockopt ioctlsocket bind WSAIoctl closesocket ntohl WSASocketW socket WSAAddressToStringW htonl htons connect setsockopt recv shutdown inet_addr WSACleanup

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

iphlpapi

GetIpAddrTable

netapi32

NetShareEnum NetApiBufferFree

rstrtmgr

RmStartSession RmGetList RmRegisterResources RmShutdown RmEndSession

bcrypt

BCryptGenRandom

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

770KB

Virtual Size

770KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ