dynowiper | 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5[.]exe

General

Target
835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe
Size 163KB
Sample260209-phk43sdz5e
SHA256 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5
MD5 a727362416834fa63672b87820ff7f27
SHA1 4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6
SHA512 57c10403889ed063bc6100038ba3e8ce68e753c0b2ca93b1e6b8232185aaba31c5a5c0ae2e41226690a65c896dc0954f6836ab9ea430df5d7caf604a2da2c500
SSDEEP 3072:fT4SpKtaWp+id2jJgc43l4l2tgQyRUJWXBVDhDq2:r4SMtaz0l1fHyaoThDR
TLSH
T1C8F37C1275D08071D573067609F8AB355A7DBD620F629ACFB7C80B0D1AB41D1AB367A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dynowiper

Malware Config

Signatures

Detects DynoWiper payload 1 IoCs

resource	yara_rule
sample	family_dynowiper

Dynowiper family
dynowiper

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe

File Explorer

835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe

.exe 163KB

835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe

IMPHASH 9956161cdbf58d343072c3eb29d186f0
SHA256 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5
MD5 a727362416834fa63672b87820ff7f27
SHA1 4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6
SHA512 57c10403889ed063bc6100038ba3e8ce68e753c0b2ca93b1e6b8232185aaba31c5a5c0ae2e41226690a65c896dc0954f6836ab9ea430df5d7caf604a2da2c500
SSDEEP 3072:fT4SpKtaWp+id2jJgc43l4l2tgQyRUJWXBVDhDq2:r4SMtaz0l1fHyaoThDR
TLSH
T1C8F37C1275D08071D573067609F8AB355A7DBD620F629ACFB7C80B0D1AB41D1AB367A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects DynoWiper payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointerEx GetLogicalDrives WriteFile WideCharToMultiByte CreateFileW MultiByteToWideChar GetConsoleOutputCP GetCurrentProcess SetConsoleOutputCP FindNextFileW CloseHandle DeleteFileW SetFileAttributesW ReadConsoleW WriteConsoleW GetDriveTypeW FindFirstFileW FindClose GetFileSize GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError HeapFree GetCommandLineA GetCPInfo RaiseException RtlUnwind HeapAlloc FreeLibrary GetProcAddress LoadLibraryExW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent GetProcessHeap ExitProcess GetModuleHandleExW HeapSize IsValidCodePage GetACP GetOEMCP GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameA GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile HeapReAlloc OutputDebugStringW SetStdHandle

user32

ExitWindowsEx

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

Sharing