r77 | b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e

Sharing

Copy URL Twitter E-mail

General

Target
b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e
Size 2.0MB
Sample231109-cbdefagb66
SHA256 b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e
MD5 e65de105c926f0f02b8828ebe637a9c0
SHA1 9e2c0e23afdd28915317fa78904da5eaad42f218
SHA512 ecd350fbec8c61d1baaebb02a879bde4061c22ecfd38f10356b363967989fa68d4c41c75d0b7996ef3a631dc66c3056a92362258397b2735d1d65085128740f0
SSDEEP 49152:Zm4u8b06GS37cXDztS/zepXT5XNyLgO1:L8TztxD5k8O1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e

File Explorer

b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e

.exe 2.0MB

b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e

IMPHASH d57109b211d135d3ec17f6be9ae88b7d
SHA256 b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e
MD5 e65de105c926f0f02b8828ebe637a9c0
SHA1 9e2c0e23afdd28915317fa78904da5eaad42f218
SHA512 ecd350fbec8c61d1baaebb02a879bde4061c22ecfd38f10356b363967989fa68d4c41c75d0b7996ef3a631dc66c3056a92362258397b2735d1d65085128740f0
SSDEEP 49152:Zm4u8b06GS37cXDztS/zepXT5XNyLgO1:L8TztxD5k8O1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64

r77 rootkit payload

Detects the payload of the r77 rootkit.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

620052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MapViewOfFile UnmapViewOfFile GetProcAddress LoadLibraryW CreateFileW ReadFile WriteFile GetLastError WaitNamedPipeW GetModuleHandleA LoadLibraryA GetPrivateProfileStringW WritePrivateProfileStringW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GetTempPathW DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize CreateFileMappingW InitializeCriticalSectionEx DeleteCriticalSection CreateProcessW GetTickCount GetModuleFileNameW GetFileAttributesW FreeLibrary LoadLibraryExW MultiByteToWideChar GetCurrentProcess GetTickCount64 IsWow64Process SetLastError WaitForSingleObject ResumeThread CreateDirectoryW LocalFree WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId Sleep CloseHandle GetProcessHeap WideCharToMultiByte GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType GetStdHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetStringTypeW EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread

user32

SetProcessDPIAware MessageBoxA MessageBoxW

advapi32

SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VariantInit

mscoree

CorBindToRuntime CLRCreateInstance

wininet

InternetReadFile InternetOpenUrlA InternetOpenA HttpQueryInfoA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

PlaySoundW

Name

.text

Size

759KB

Virtual Size

759KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

360KB

Virtual Size

360KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

848KB

Virtual Size

847KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b15afb145448344701a010445c1a13996ae6853fdcd8ae8441ff2eca4121429e

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

wininet

version

winmm

generic