RegulusServer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RegulusServer.exe
Size

212KB
MD5

e10cb106f700b0d27e6e9d18a16dcfa1
SHA1

d1daea11a64e776a91db03e2407fde0e84a48a86
SHA256

7b40e45e7e72fecf5e1821d63de7a23a274ca4d372a1fad12793496567286a5b
SHA512

251d7eb79ec5e40f247da3e3a80991ccd7ca1499cf38ad1a757e347e7404842d8ed4003141b2137df590fadf7018b0de74eb28bd840ab44893d7205d2256880b
SSDEEP

3072:FjtBmZKFFoRb94MhrSkhBDwhu0p/mjO/0SPo6Ce:FjHYN94YrjXDwhu0p/mju

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RegulusServer.exe

Files

RegulusServer.exe
.exe windows:4 windows x86

bbd24d4d23254098aecd7135d2fd29cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetProcAddress
Sleep
LCMapStringW
LCMapStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
ReadFile
FlushFileBuffers
SetStdHandle
VirtualAlloc
HeapReAlloc
HeapAlloc
CreateFileA
MultiByteToWideChar
SetConsoleCtrlHandler
RtlUnwind
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStartupInfoA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
SetHandleCount
GetFileType
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetLastError
CloseHandle
GetModuleHandleA

rcapi

AppGetUttStatusPublicWrapper
AppSetBeginSpeechTimeoutPublicWrapper
AppSetEndSpeechTimeoutPublicWrapper
AppSetEndRecognitionTimeoutPublicWrapper
AppSetRejectionThresholdPublicWrapper
AppSetBargeInAllowedPublicWrapper
AppSetIntParameterPublicWrapper
AppGotoPublicWrapper
AppAppendNumberPromptPublicWrapper
AppAppendPromptPublicWrapper
AppAppendTTSPromptPublicWrapper
AppPlayPromptsPublicWrapper
AppSetGrammarPublicWrapper
AppRecognizePublicWrapper
AppGotoSelfPublicWrapper
AppNewPublicWrapper
AppCreateStateClassPublicWrapper
AppCreateStatePublicWrapper
AppGoPublicWrapper
NLGetIthFeatureNameAndTypePublicWrapper
NLGetFeatureValuePublicWrapper
NLGetLengthOfListPublicWrapper
NLGetIthValueAndTypeInListPublicWrapper
NLGetStringFromValuePublicWrapper
NLGetIntFromValuePublicWrapper
AppGetRecResultPublicWrapper
AppGetNLResultPublicWrapper
NLNewValuePublicWrapper
NLGetNumberOfFilledSlotsPublicWrapper
RecResultOverallConfidencePublicWrapper
RecResultStringPublicWrapper
NLGetIthSlotNameAndTypePublicWrapper
NLGetSlotValuePublicWrapper
AppSetRecordFilenamePublicWrapper
AppRecordPublicWrapper

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbd24d4d23254098aecd7135d2fd29cb

Headers

File Characteristics

Imports

kernel32

rcapi

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 16KB - Virtual size: 23KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 16KB - Virtual size: 23KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 4KB