r77 | 9746206d224136a0a0551d3b7c788debfcadc645987e5cdc23932ec18881a880

Sharing

Copy URL

Twitter E-mail

General

Target

9746206d224136a0a0551d3b7c788debfcadc645987e5cdc23932ec18881a880
Size

1.4MB
MD5

2511fe28f531796add604b0ade6d3a1d
SHA1

3d100c221cdf95d44dfa8bff9a8a0fdf2fa42e26
SHA256

9746206d224136a0a0551d3b7c788debfcadc645987e5cdc23932ec18881a880
SHA512

2593409a67a5905d5b4bb2107136bd164b1cb979f463ee8a289494a5ee7bf6bc507443b99871bbd19f576e045f22f5212d9b4693b99a72b55f83a1d3225398d4
SSDEEP

24576:kR6tsHXFt6vhhEf6DSVXT5X5vrHMp9gjIya:k/X76ZhOvXT5X5THMp9gjI1

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9746206d224136a0a0551d3b7c788debfcadc645987e5cdc23932ec18881a880

Files

9746206d224136a0a0551d3b7c788debfcadc645987e5cdc23932ec18881a880
.exe windows:6 windows x64 arch:x64

7e40d7287e98a306a412330139af10c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
LockResource
GetFileAttributesW
GetModuleFileNameW
IsWow64Process
ResumeThread
WaitForSingleObject
GetTempPathW
CreateDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
GetModuleHandleA
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentProcess
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
WriteFile
GetStdHandle
ExitProcess
LoadLibraryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetProcAddress
SetLastError
FreeEnvironmentStringsW
LoadLibraryA
Sleep
CreateFileW
GetLastError
GetCurrentProcessId
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
CompareStringEx
GetSystemTimeAsFileTime
FreeLibrary
GetConsoleMode
CloseHandle
FlsFree
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetLocaleInfoEx
EncodePointer
LCMapStringEx
QueryPerformanceCounter
WakeAllConditionVariable
SleepConditionVariableSRW
FlsAlloc
FlsGetValue
FlsSetValue

user32

TranslateMessage
DispatchMessageW
PostMessageW
GetMessageW
TranslateAcceleratorW
LoadCursorW
CreateWindowExW
SendMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
LoadIconW
RegisterClassExW
GetSystemMetrics
SetWindowLongPtrW
ShowWindow
UpdateWindow
GetDC
GetWindowRect
UpdateLayeredWindow
ReleaseDC
GetWindowLongPtrW
DefWindowProcW
SetLayeredWindowAttributes
BeginPaint
EndPaint
PostQuitMessage
SetTimer
SetCursor
KillTimer
ReleaseCapture
MoveWindow
LoadAcceleratorsW

gdi32

DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject
CreateFontIndirectW

shell32

SHGetFolderPathW

ole32

CreateStreamOnHGlobal

gdiplus

GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipGetImageWidth
GdipGetImageHeight
GdipCreateTexture
GdipCreateTextureIAI
GdipSetTextureWrapMode
GdipTranslateTextureTransform
GdipFillRectangleI
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipGetTextureImage
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateSolidFill
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipSetStringFormatFlags
GdipDeleteFont
GdipSetSolidFillColor
GdipMeasureString
GdipDrawString
GdipDeleteGraphics
GdipSetStringFormatAlign
GdipFree
GdipCloneImage
GdipDeleteBrush
GdipCloneBrush
GdipCreateFromHDC

winmm

PlaySoundW
mciSendStringW

comctl32

InitCommonControlsEx
_TrackMouseEvent

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 878KB - Virtual size: 877KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e40d7287e98a306a412330139af10c1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

gdiplus

winmm

comctl32

version

Sections

.text Size: 446KB - Virtual size: 445KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 8KB - Virtual size: 16KB

.pdata Size: 17KB - Virtual size: 16KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 878KB - Virtual size: 877KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 446KB - Virtual size: 445KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 8KB - Virtual size: 16KB

.pdata
Size: 17KB - Virtual size: 16KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 878KB - Virtual size: 877KB

.reloc
Size: 4KB - Virtual size: 3KB