fannyworm | sub_5d411570fc45[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_5d411570fc45.bin
Size 180KB
Sample260524-bt6chadv4p
SHA256 5d411570fc456403797add124bcef890238c2c94c7997972db30121132e81a95
MD5 e10a9df3745684581ea3cf5ab22e3e90
SHA1 d15f43f14372862111560cdcf48fd3c15418f1ea
SHA512 923a6d3af4bd4cd805d2bc589dd3723c4e59ee626844d480c6189085d774240af2c8f33f9da7e9fabbc38d56f59a55b21fbe0a3130674a181bb4523ea1ad6183
SSDEEP 3072:TtnUNALmVZvvGBeLYejpkIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:p4LvkRejpequn2TB8i4i0zLOosqHkG
TLSH
T16E048E0A9B9702A3DAA4043071945ABB7FBE7C3338DF646FCB165A3115A15C5D034EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm apt equation_group fannyworm

Malware Config

Signatures

Family: FannyWorm
FannyWorm is a Windows worm attributed to Equation Group.
worm fannyworm

Detects FannyWorm 1 IoCs

worm apt equation_group

resource	yara_rule
sample	family_fannyworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_5d411570fc45.bin

File Explorer

sub_5d411570fc45.bin

.dll 180KB

sub_5d411570fc45.bin

IMPHASH 1f5e76572fad36553733428ca3571f53
SHA256 5d411570fc456403797add124bcef890238c2c94c7997972db30121132e81a95
MD5 e10a9df3745684581ea3cf5ab22e3e90
SHA1 d15f43f14372862111560cdcf48fd3c15418f1ea
SHA512 923a6d3af4bd4cd805d2bc589dd3723c4e59ee626844d480c6189085d774240af2c8f33f9da7e9fabbc38d56f59a55b21fbe0a3130674a181bb4523ea1ad6183
SSDEEP 3072:TtnUNALmVZvvGBeLYejpkIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:p4LvkRejpequn2TB8i4i0zLOosqHkG
TLSH
T16E048E0A9B9702A3DAA4043071945ABB7FBE7C3338DF646FCB165A3115A15C5D034EEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects FannyWorm

worm apt equation_group
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

htonl

kernel32

FindClose FindFirstFileA GetVolumeInformationA WaitForSingleObject CreateMutexA OpenMutexA ReadFile FindNextFileA FreeLibrary GetTempPathA GetSystemDirectoryA GetSystemTime lstrlenA lstrcpynA GetComputerNameA OpenProcess GetVersionExA GetModuleFileNameA LocalFree LocalAlloc GetCurrentProcess GetCurrentThread CreateMutexW SetLastError lstrcpyA GetVersion lstrcatA VirtualFree ReleaseMutex VirtualAlloc OpenMutexW GetModuleHandleA LoadLibraryExA IsBadReadPtr CreateFileW GetEnvironmentVariableW LoadLibraryW MapViewOfFile CreateFileMappingA LoadLibraryA SetFilePointer GetProcAddress CreateThread Sleep CreateFileA WriteFile CloseHandle GetFileTime SetFileTime CreateProcessA BeginUpdateResourceA UpdateResourceA EndUpdateResourceA FindResourceA LoadResource SizeofResource LockResource DeleteFileA GetLastError CopyFileA SetFileAttributesA GetEnvironmentVariableA GetCurrentProcessId GetFileSize

user32

UnregisterClassA SetPropA CreateWindowExW DestroyWindow wsprintfA UnregisterClassW

advapi32

RegDeleteValueA RegEnumValueA LookupAccountNameA RegEnumKeyExA LookupAccountSidA IsValidSid AccessCheck OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetUserNameW LookupAccountSidW AllocateAndInitializeSid FreeSid RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegCloseKey RegSetValueExA SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl DuplicateTokenEx OpenThreadToken GetSidIdentifierAuthority SetSecurityDescriptorDacl

msvcrt

_mbschr _local_unwind2 strcmp wcsncat wcscpy strncmp _wcsicmp _adjust_fdiv _itoa _stricmp sscanf strcat memset strstr strncpy memcpy strlen malloc strcpy free strncat memcmp _snprintf _ftol realloc _abnormal_termination wcscmp wcslen ??3@YAXPAX@Z ??2@YAPAXI@Z _initterm