Behavioral task
behavioral1
Sample
smert.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
smert.exe
Resource
win10v2004-20240802-en
General
-
Target
smert.exe
-
Size
20KB
-
MD5
9741dc2a48ef315a5032a3190c6a9752
-
SHA1
595cfcf134ac6a97a75407350b509ad37666d546
-
SHA256
419b6c03a01ad10354c6f70c9077d0bc97a04ca03d0e39748823c8d604da7fe2
-
SHA512
a8f26e08cdb7078f51f716014499f4af3f0be2ed057cbc3f67da38120d69534ff05a010ab8879ec5bfc692caac7db6f47e777d701d733a6cda307aaddb70cb6f
-
SSDEEP
384:asaFiLCCr05Sx158JLLU4Act6GoMZOaB8BYsszReS:aPwXl1585LUNGoMZOXszR
Malware Config
Signatures
-
resource yara_rule sample SmertRansomware -
Smert family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource smert.exe
Files
-
smert.exe.exe windows:6 windows x64 arch:x64
6b229c4aa1aae59badf58a0f6071a347
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptReleaseContext
CryptSetKeyParam
CheckTokenMembership
FreeSid
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
AllocateAndInitializeSid
CryptGenRandom
CryptEncrypt
CryptAcquireContextA
CryptDestroyKey
shell32
ShellExecuteExA
SHGetKnownFolderPath
ShellExecuteA
ole32
CoTaskMemFree
wininet
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
CloseThreadpool
CreateThreadpool
FindFirstFileA
GetDriveTypeA
FindNextFileA
FindClose
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
Sleep
GetLastError
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
CreateThreadpoolWork
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
vcruntime140
memset
__C_specific_handler
strstr
__current_exception
strrchr
__current_exception_context
memcpy
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_initialize_onexit_table
_crt_atexit
terminate
exit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_exit
_get_initial_narrow_environment
_initterm
_initterm_e
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_cexit
_c_exit
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-stdio-l1-1-0
fopen
fread
__p__commode
feof
__acrt_iob_func
fclose
__stdio_common_vsprintf
fwrite
__stdio_common_vfprintf
_set_fmode
api-ms-win-crt-filesystem-l1-1-0
remove
_stat64i32
api-ms-win-crt-string-l1-1-0
_stricmp
_strdup
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ