egregor | 01b3f6b2bca082287830f076cc113fda_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
01b3f6b2bca082287830f076cc113fda_JaffaCakes118
Size 1.2MB
Sample240426-1a6llace87
SHA256 78b884867857e7152788fa7ecbd3ded81b930b2e5fadebdd47ba0be356ec7e1e
MD5 01b3f6b2bca082287830f076cc113fda
SHA1 b620d57802ee0cea72b13b23f1ea75bdc7633114
SHA512 38465d58dde766ff2683ffe7a645adf4befcf2af7dbc2e6b9041f55a24cefacbbc5b0d10467d6b9e68c1066fc9e4caf6a0a91b6f4e64dc1ba7034bcd8088b326
SSDEEP 24576:P4JgqzfJ45qhAceTXipNyxD9PD8sOx/nZUC/dfNyGNS:P4aXipNo9QsoUwd1hc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

egregor

Malware Config

Signatures

Detected Egregor ransomware 1 IoCs

resource	yara_rule
sample	family_egregor

Egregor family
egregor

File Explorer

01b3f6b2bca082287830f076cc113fda_JaffaCakes118

.exe 1.2MB

01b3f6b2bca082287830f076cc113fda_JaffaCakes118

IMPHASH e71f628c5e485d244428c8cec73b3013
SHA256 78b884867857e7152788fa7ecbd3ded81b930b2e5fadebdd47ba0be356ec7e1e
MD5 01b3f6b2bca082287830f076cc113fda
SHA1 b620d57802ee0cea72b13b23f1ea75bdc7633114
SHA512 38465d58dde766ff2683ffe7a645adf4befcf2af7dbc2e6b9041f55a24cefacbbc5b0d10467d6b9e68c1066fc9e4caf6a0a91b6f4e64dc1ba7034bcd8088b326
SSDEEP 24576:P4JgqzfJ45qhAceTXipNyxD9PD8sOx/nZUC/dfNyGNS:P4aXipNo9QsoUwd1hc
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detected Egregor ransomware

Digest

fb:f1:f8:06:ff:51:22:aa:bb:53:e2:b0:45:80:cf:f9:94:e5:10:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 24, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0e:21:a7:5f:74:d4:98:4f:3e:60:fb:42:36:95:29:5f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2018 - Mar 31, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

32166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

b:\b\discord_desktop\build\x86_mt\DiscordHookHelper.exe.pdb

kernel32

Thread32First Thread32Next CreateEventW GetFileAttributesA GetFileAttributesW MoveFileExW GetCurrentProcessId ProcessIdToSessionId OpenProcess LocalFree VirtualAlloc VirtualFree VirtualQuery HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree Sleep GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect GetSystemInfo GetNativeSystemInfo VirtualQueryEx ReadProcessMemory IsWow64Process GetSystemTimeAsFileTime lstrcmpiW QueryFullProcessImageNameW Process32FirstW Process32NextW RtlCaptureStackBackTrace WriteConsoleW ReadConsoleW ReadFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetProcessId GetExitCodeThread GetProcessTimes SetLastError OpenFileMappingA LoadLibraryW GetModuleHandleA UnmapViewOfFile MapViewOfFile GetSystemDirectoryW Module32NextW Module32FirstW CreateToolhelp32Snapshot GetModuleHandleW GetModuleFileNameW GetCurrentProcess WaitForSingleObject GetLastError GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW CloseHandle GetFinalPathNameByHandleW GetProcAddress CreateFileW OutputDebugStringA GetCommandLineW VerifyVersionInfoW VerSetConditionMask GetModuleHandleExW SetConsoleCtrlHandler GetFileType WriteFile GetStdHandle ExitProcess ExitThread RtlUnwind RaiseException QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetVersionExW SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx FormatMessageW

user32

CreateWindowExA UnhookWindowsHookEx PostThreadMessageW EnumThreadWindows RegisterClassA DefWindowProcA IsWindowVisible GetWindow GetWindowThreadProcessId EnumWindows EnumChildWindows GetWindowLongW

advapi32

SetEntriesInAclW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation ConvertSidToStringSidA RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW SetSecurityInfo SetNamedSecurityInfoW GetSecurityInfo GetNamedSecurityInfoW OpenProcessToken FreeSid AllocateAndInitializeSid RegGetValueW

shell32

CommandLineToArgvW

ole32

CoTaskMemFree CoUninitialize CoSetProxyBlanket CoCreateInstance CoInitializeEx

oleaut32

VariantClear

shlwapi

PathRemoveFileSpecW PathFindFileNameW wnsprintfW

crypt32

CryptMsgClose CryptMsgGetParam CertFindCertificateInStore CertFreeCertificateContext CryptHashPublicKeyInfo CertGetNameStringW CryptQueryObject CertCloseStore

psapi

QueryWorkingSet EnumProcesses GetModuleInformation EnumProcessModulesEx GetModuleFileNameExW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

01b3f6b2bca082287830f076cc113fda_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

psapi

wintrust

generic