r77 | 7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef.exe
Size 1.2MB
Sample260320-vlthhsbz2r
SHA256 7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef
MD5 ebcf1ea09f31713a97a1c5e0d9c51cdf
SHA1 6b9c79e23cf54a7b68d9d36e98f8f6af1e2708d6
SHA512 0b8e1d22f64c2003eb72d76dabc7c1222d0967c26e118e5a902418ed70c01845a5046d0f431d678a715388116a23299aa2a66bf0afedd84e864b848de347fd0a
SSDEEP 24576:FYUrQABbyYRTRyJYzOuA47p03qgGKpigjU8K5KVIDSSPcm4bJ7K:jMABbRtyUlpF8KVKV7K
TLSH
T1F455BF4667A404F9E0A79138C9538D06E7B2B8060771DBDF13A0877A6F277E15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
sample	r77_payload

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef.exe

File Explorer

7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef.exe

.exe 1.2MB

7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef.exe

IMPHASH 99dde9683e2c2f1aa87a0ae0b5b0d41c
SHA256 7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef
MD5 ebcf1ea09f31713a97a1c5e0d9c51cdf
SHA1 6b9c79e23cf54a7b68d9d36e98f8f6af1e2708d6
SHA512 0b8e1d22f64c2003eb72d76dabc7c1222d0967c26e118e5a902418ed70c01845a5046d0f431d678a715388116a23299aa2a66bf0afedd84e864b848de347fd0a
SSDEEP 24576:FYUrQABbyYRTRyJYzOuA47p03qgGKpigjU8K5KVIDSSPcm4bJ7K:jMABbRtyUlpF8KVKV7K
TLSH
T1F455BF4667A404F9E0A79138C9538D06E7B2B8060771DBDF13A0877A6F277E15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

r77 rootkit payload

Detects the payload of the r77 rootkit.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

34:59:f0:2b:6e:72:31:91:6e:65:3b:df:94:3e:7e:63:19:41:ce:02:fb:af:2b:48:4d:89:0b:50:b3:61:ef:db

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=OOO Lightshot,O=OOO Lightshot,L=Novosibirsk,ST=Novosibirsk,C=RU

Chains

Apr 12, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=OOO Lightshot,O=OOO Lightshot,L=Novosibirsk,ST=Novosibirsk,C=RU

Serial Number

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7a

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 8, 2016 - Jul 8, 2019

Minor OS version

Major OS version

Entry point

179792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcessId LoadLibraryW GetProcAddress WaitNamedPipeW GetLastError CreateFileW ReadFile WriteFile GetModuleHandleA LoadLibraryA GetPrivateProfileStringW WritePrivateProfileStringW GetModuleHandleW FindResourceW LoadResource SizeofResource LockResource Sleep GetModuleFileNameW LoadLibraryExW FreeLibrary MultiByteToWideChar GetCurrentProcess IsWow64Process SetLastError ResumeThread WaitForSingleObject GetFileSizeEx LocalFree GetTempPathW CreateDirectoryW WriteConsoleW HeapSize MapViewOfFile CreateFileMappingW UnmapViewOfFile GetFileAttributesW CloseHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetStdHandle GetFullPathNameW GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WideCharToMultiByte GetStringTypeW WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle HeapFree HeapAlloc SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CompareStringW LCMapStringW GetLocaleInfoW

user32

MessageBoxA MessageBoxW

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy

mscoree

CorBindToRuntime CLRCreateInstance

wininet

InternetReadFile InternetOpenUrlA InternetOpenA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW

Name

.text

Size

338KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

761KB

Virtual Size

761KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7a8004afafd5a81ffb256fed047585e3a15e4d33916601de9d4c5448752b4eef.exe

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

mscoree

wininet

version

winmm

generic