royal | 595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9.exe
Size 2.1MB
Sample230509-v5bf2sda95
SHA256 595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9
MD5 c46070b5e113a7f5d9a58de14a11e430
SHA1 5007943bec2cf5310cfe8b8c49d6f55f79ad0e4c
SHA512 e77a2bbc22974f79f30f6673adaf78c8818d674532ef1cff4d61514ecb3d1aec0459d76c05595d1c650624bf25d4e4f06ee14841b5c2b1c5a20a27e4861ae818
SSDEEP 24576:R+KpPzIzkQoU6TPF8mkoSW12GR7qMA6v0Xwq8UcNV++e/i5dv9jOlRJYzyiMAIQB:Bq9LmKKe36MmYJPAvIPtHzHlh4UC4qki
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware royal

Malware Config

Signatures

Royal Ransomware 1 IoCs

ransomware

resource	yara_rule
sample	family_royal

Royal family
royal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9.exe

File Explorer

595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9.exe

.exe 2.1MB

595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9.exe

IMPHASH 07a5f14fabca497d51b3abff84669c94
SHA256 595c869f8ec7eaf71fef44bad331d81bb934c886cdff99e1f013eec7acdaf8c9
MD5 c46070b5e113a7f5d9a58de14a11e430
SHA1 5007943bec2cf5310cfe8b8c49d6f55f79ad0e4c
SHA512 e77a2bbc22974f79f30f6673adaf78c8818d674532ef1cff4d61514ecb3d1aec0459d76c05595d1c650624bf25d4e4f06ee14841b5c2b1c5a20a27e4861ae818
SSDEEP 24576:R+KpPzIzkQoU6TPF8mkoSW12GR7qMA6v0Xwq8UcNV++e/i5dv9jOlRJYzyiMAIQB:Bq9LmKKe36MmYJPAvIPtHzHlh4UC4qki
MD5 SHA1 SHA512 SSDEEP

windows x86

Royal Ransomware

ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1509128

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetQueuedCompletionStatus CreateIoCompletionPort SleepConditionVariableCS ReadFile GetFileSizeEx GetCurrentProcess WakeAllConditionVariable GetProcessId SetEndOfFile CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW GetNativeSystemInfo SetFilePointerEx MoveFileExW FlushFileBuffers SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA FormatMessageA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualFree GetEnvironmentVariableW MultiByteToWideChar GetACP GetStdHandle CancelIo GetModuleHandleW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize GetTimeZoneInformation GetProcessHeap GetStringTypeW SetEnvironmentVariableW lstrcmpW WideCharToMultiByte CreateProcessW ExitProcess DeleteCriticalSection WaitForSingleObject lstrlenA InitializeConditionVariable InitializeCriticalSection WaitForMultipleObjects lstrlenW GetCommandLineW lstrcmpiW CreateThread CloseHandle Sleep FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA DecodePointer GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetFullPathNameW GetCurrentDirectoryW SetStdHandle GetConsoleOutputCP HeapReAlloc LCMapStringW CompareStringW HeapAlloc HeapFree GetModuleFileNameW SetConsoleCtrlHandler GetModuleHandleExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW EncodePointer LoadLibraryExW ExitThread CreateFileW FindClose LeaveCriticalSection WriteFile FindNextFileW EnterCriticalSection FindFirstFileW GetFileType GetLogicalDrives InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

wsprintfW GetUserObjectInformationW MessageBoxW GetProcessWindowStation

advapi32

DeregisterEventSource CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash ReportEventW RegisterEventSourceW CryptAcquireContextW CryptEnumProvidersW CryptSignHashW

shell32

CommandLineToArgvW

shlwapi

StrStrIW

ws2_32

WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr send WSACleanup gethostbyname select ntohs getsockopt ioctlsocket bind WSAIoctl closesocket ntohl WSASocketW socket WSAAddressToStringW htonl htons WSAStartup connect recv setsockopt shutdown WSAGetLastError

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

iphlpapi

GetIpAddrTable

netapi32

NetShareEnum NetApiBufferFree

rstrtmgr

RmStartSession RmGetList RmRegisterResources RmShutdown RmEndSession

bcrypt

BCryptGenRandom