royal | 51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff

Sharing

Copy URL Twitter E-mail

General

Target
51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff
Size 2.1MB
Sample230329-xsna7abc2s
SHA256 51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff
MD5 052172a232ff82884501ad4559c03cf7
SHA1 1140ae5ff931f09226d288c44c368c167442934a
SHA512 aea4c521c2689e2f4513f5fce6d7b5ee0fbe067d685dc8100453fc8c921741e13ecce6b8146dc71971875592621c9ad4cc6724246aa906348bcdacbdfe639e76
SSDEEP 24576:P+KpPzIzkQoU6cvTJdCm6pMtGMt0p0LkeoqP5nV6BQ1s2Y/tJGnX+LuiehI6YL23:Dq9FTZGkvtOqYwrUPJwzjOQsh6b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware royal

Malware Config

Signatures

Royal Ransomware 1 IoCs

ransomware

resource	yara_rule
sample	family_royal

Royal family
royal

File Explorer

51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff

.exe 2.1MB

51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff

IMPHASH 3a45ce41fbc6d362dd2f153d51234462
SHA256 51ec21268902bf9d98069df7f3c56a5da19cee226fb9c3c1cfe5889c1f48edff
MD5 052172a232ff82884501ad4559c03cf7
SHA1 1140ae5ff931f09226d288c44c368c167442934a
SHA512 aea4c521c2689e2f4513f5fce6d7b5ee0fbe067d685dc8100453fc8c921741e13ecce6b8146dc71971875592621c9ad4cc6724246aa906348bcdacbdfe639e76
SSDEEP 24576:P+KpPzIzkQoU6cvTJdCm6pMtGMt0p0LkeoqP5nV6BQ1s2Y/tJGnX+LuiehI6YL23:Dq9FTZGkvtOqYwrUPJwzjOQsh6b
MD5 SHA1 SHA512 SSDEEP

windows x86

Royal Ransomware

ransomware

Minor OS version

Major OS version

Entry point

1510200

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrIW

ws2_32

WSAStartup shutdown setsockopt connect send recv WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr WSAGetLastError WSACleanup gethostbyname select ntohs getsockopt ioctlsocket bind WSAIoctl closesocket ntohl WSASocketW socket WSAAddressToStringW htonl htons

crypt32

CertEnumCertificatesInStore CertOpenStore CertFindCertificateInStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertCloseStore

advapi32

CryptGetUserKey CryptReleaseContext CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptSetHashParam CryptGetProvParam CryptAcquireContextW

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW

shell32

ShellExecuteW CommandLineToArgvW

iphlpapi

GetIpAddrTable

netapi32

NetShareEnum NetApiBufferFree

rstrtmgr

RmStartSession RmGetList RmShutdown RmEndSession RmRegisterResources

bcrypt

BCryptGenRandom

kernel32

CompareStringW HeapAlloc HeapFree GetModuleFileNameW SetConsoleCtrlHandler LCMapStringW HeapReAlloc GetConsoleOutputCP SetStdHandle GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap GetTimeZoneInformation HeapSize GetModuleHandleExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle LoadLibraryExW InitializeCriticalSectionAndSpinCount EncodePointer WriteConsoleW WideCharToMultiByte RaiseException RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLogicalDrives FindFirstFileW EnterCriticalSection FindNextFileW WriteFile LeaveCriticalSection FindClose CreateFileW ExitThread Sleep CloseHandle CreateThread lstrcmpiW GetDriveTypeW GetCommandLineW GetCurrentProcess lstrlenW WaitForMultipleObjects InitializeCriticalSection InitializeConditionVariable CreateMutexW lstrlenA WaitForSingleObject GetLastError GetProcAddress DeleteCriticalSection ExitProcess CreateProcessW GetModuleHandleW DecodePointer lstrcmpW CancelIo GetQueuedCompletionStatus CreateIoCompletionPort SleepConditionVariableCS ReadFile GetFileSizeEx WakeAllConditionVariable GetProcessId SetEndOfFile CreateToolhelp32Snapshot Process32NextW Process32FirstW GetNativeSystemInfo SetFilePointerEx MoveFileExW FlushFileBuffers SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualFree GetEnvironmentVariableW MultiByteToWideChar GetACP GetStdHandle GetFileType GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW