krustyloader | rqbit[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rqbit.exe
Size 11.2MB
Sample250706-qyl7rayscv
SHA256 50005bc5022760869dd35e35cb09fcf765f637a0c0e939d7bd28ef81c148d5c1
MD5 dbf8bc7b37be22d062b19b11fa468f69
SHA1 a6f42d684613337f4d0e787bbb693b908833e9a1
SHA512 7c953c9854c5f31683dace106eae835a98ea50ef5f98e9d9c84c66d3791c742a7a91f7d6f4b89e35cea530e66e80bc7dc7f36b2dbbfbaee5e0e62463da76d259
SSDEEP 98304:RBpnVPF8jo4B6gh+1esbZh/lOt1saVV18AtEeunrqtNiQ2:R7YA8tR0eundQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

krustyloader

Malware Config

Signatures

Detects KrustyLoader family 1 IoCs

resource	yara_rule
sample	family_krustyloader

Krustyloader family
krustyloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rqbit.exe

File Explorer

rqbit.exe

.exe 11.2MB

rqbit.exe

IMPHASH b0a62099623796254c317e0a23b1f4a7
SHA256 50005bc5022760869dd35e35cb09fcf765f637a0c0e939d7bd28ef81c148d5c1
MD5 dbf8bc7b37be22d062b19b11fa468f69
SHA1 a6f42d684613337f4d0e787bbb693b908833e9a1
SHA512 7c953c9854c5f31683dace106eae835a98ea50ef5f98e9d9c84c66d3791c742a7a91f7d6f4b89e35cea530e66e80bc7dc7f36b2dbbfbaee5e0e62463da76d259
SSDEEP 98304:RBpnVPF8jo4B6gh+1esbZh/lOt1saVV18AtEeunrqtNiQ2:R7YA8tR0eundQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects KrustyLoader family
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8603724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rqbit.pdb

kernel32

SetFileCompletionNotificationModes QueryPerformanceFrequency FlushFileBuffers FlushViewOfFile GetCurrentProcessId CreateFileMappingW MapViewOfFile WaitForSingleObjectEx CreateFileW CreateSemaphoreW ReadDirectoryChangesW ReleaseSemaphore GetModuleHandleA SetFileInformationByHandle UnmapViewOfFile FindClose SwitchToThread GetComputerNameExW WaitForSingleObject GetCurrentThreadId lstrlenW GetSystemTimeAsFileTime GetSystemInfo Sleep QueryPerformanceCounter GetSystemTimePreciseAsFileTime SetConsoleTextAttribute IsProcessorFeaturePresent GetModuleHandleW GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread RtlCaptureContext GetCurrentProcess RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetStdHandle SetFilePointerEx HeapReAlloc FormatMessageW HeapAlloc FindNextFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW FindFirstFileExW DeleteFileW MoveFileExW RemoveDirectoryW GetFinalPathNameByHandleW HeapFree ExitProcess GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte ReadConsoleW CreateThread GetFileType GetProcessHeap InitializeSListHead GetFullPathNameW LoadLibraryA CreateMutexA ReleaseMutex GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetHandleInformation RtlLookupFunctionEntry VirtualProtect SetLastError CancelIo GetQueuedCompletionStatusEx CreateIoCompletionPort DuplicateHandle PostQueuedCompletionStatus DeviceIoControl CloseHandle GetLastError

ntdll

RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtReadFile

ole32

CoTaskMemFree

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

CryptCreateHash CryptGetHashParam SystemFunction036 CryptHashData GetUserNameW CryptDestroyHash CryptReleaseContext CryptAcquireContextW

shell32

SHGetKnownFolderPath

ws2_32

WSARecv send WSACleanup recv sendto WSAIoctl freeaddrinfo accept WSASendTo socket getsockname connect getsockopt WSAGetLastError shutdown closesocket bind ioctlsocket WSASocketW setsockopt listen getaddrinfo getpeername recvfrom WSAStartup WSASend

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CertOpenStore CertDuplicateCertificateChain

iphlpapi

ConvertLengthToIpv4Mask ConvertInterfaceLuidToIndex GetAdaptersAddresses

secur32

FreeCredentialsHandle DeleteSecurityContext AcquireCredentialsHandleA ApplyControlToken FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW EncryptMessage DecryptMessage

vcruntime140

__current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memset memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

cbrt __setusermatherr pow log1p exp ceil log

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _initterm _register_thread_local_exe_atexit_callback _c_exit _cexit _initterm_e exit _exit __p___argv _set_app_type _register_onexit_function _initialize_onexit_table _crt_atexit _get_initial_narrow_environment __p___argc terminate _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale