gazer | c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84

Sharing

Copy URL Twitter E-mail

General

Target
c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84
Size 394KB
Sample260604-sthd4sas7m
SHA256 c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84
MD5 b29ee2e39e31d3938238a6bcc517011e
SHA1 2dc3f4bc761e41191419862465b58fba9092c319
SHA512 6ba7ebf4dd214f6e619d14accbad45ae5d06317729ffc4ce657c45244f46d8c9a2909998fe2611ec76a8ca0ad4fccff62d3281bb6e2cfdb1109c7f54de55655d
SSDEEP 6144:qvDjmMZn66J0wf5R+BUUzYsdPPDfTT/+15ZFWajNyLG:2DTZn3JFaJ86jn/+PqiyL
TLSH
T16D845B1232F5147EF2F72A705BB397165EB7BD501821C45F42883D4A98F3A86EE29327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor gazer

Malware Config

Signatures

Family: Gazer,WhiteBear
Gazer aka WhiteBear is Second-stage backdoor used by the Turla APT group, written in C++.
backdoor gazer

Detects Gazer Backdoor 1 IoCs

resource	yara_rule
sample	family_gazer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84

File Explorer

c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84

.dll 394KB

c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84

IMPHASH b0095e22735d357ddb128c7622371b25
SHA256 c5db84fe0f762ebc2abe484d59d51fdf35a37f3a32e6f44d8197b1e8cda98e84
MD5 b29ee2e39e31d3938238a6bcc517011e
SHA1 2dc3f4bc761e41191419862465b58fba9092c319
SHA512 6ba7ebf4dd214f6e619d14accbad45ae5d06317729ffc4ce657c45244f46d8c9a2909998fe2611ec76a8ca0ad4fccff62d3281bb6e2cfdb1109c7f54de55655d
SSDEEP 6144:qvDjmMZn66J0wf5R+BUUzYsdPPDfTT/+15ZFWajNyLG:2DTZn3JFaJ86jn/+PqiyL
TLSH
T16D845B1232F5147EF2F72A705BB397165EB7BD501821C45F42883D4A98F3A86EE29327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows

Detects Gazer Backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5771

Magic Number

267

Subsystem

MAGE_SUBSYSTEM_UNKNOWN

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_adjust_fdiv _initterm _iob ??1type_info@@UAE@XZ srand rand wcstoul vswprintf swprintf strcpy vsprintf exit malloc free fprintf _wrename _wcsnicmp memcmp _wcslwr wcsncpy wcschr wcscmp strlen wcscat sprintf _wcsicmp wcscpy wcsstr wcsrchr wcslen _endthreadex _purecall ??2@YAPAXI@Z ??3@YAXPAX@Z memset _wgetenv _snwprintf memcpy _beginthreadex

kernel32

GetProcessHeap ResetEvent LocalFree GetLongPathNameW GetCurrentThread GetEnvironmentVariableA WideCharToMultiByte CreateFileA GetTempFileNameW CreatePipe CreateFileMappingW GetExitCodeProcess SetHandleInformation PeekNamedPipe GetSystemTime GetVolumeInformationW SetEndOfFile SetFilePointer SizeofResource LoadResource FindResourceW SetNamedPipeHandleState GetNamedPipeHandleStateW TerminateThread ExitThread GetHandleInformation GetExitCodeThread CloseHandle ResumeThread GetCommandLineW HeapAlloc SetUnhandledExceptionFilter HeapFree InterlockedCompareExchange Sleep HeapDestroy HeapCreate GetProcessHeaps DisableThreadLibraryCalls GetLocalTime CreateEventW WaitForMultipleObjects GetCurrentThreadId DeleteFileW GetCurrentProcessId MapViewOfFile UnmapViewOfFile CreateProcessW GetCurrentProcess WaitForSingleObject SetEvent SetFileTime WriteFile InitializeCriticalSection LeaveCriticalSection HeapValidate CreateFileW GetStartupInfoW GetLastError EnterCriticalSection GetFileTime DeleteCriticalSection DuplicateHandle FreeLibrary SystemTimeToTzSpecificLocalTime LoadLibraryW GetVersionExW FileTimeToSystemTime GetProcAddress lstrcmpiW GetWindowsDirectoryW FindFirstFileW lstrlenW lstrcatW FindNextFileW GetShortPathNameW lstrcpyW GetModuleHandleW ReadProcessMemory MultiByteToWideChar HeapReAlloc TlsGetValue TlsSetValue FlushFileBuffers TlsFree SetFileAttributesW GetThreadContext GetFileSize SetThreadContext VirtualFree OpenProcess VirtualFreeEx ReadFile VirtualAlloc VirtualAllocEx OpenThread GetModuleHandleA VirtualProtect SuspendThread TerminateProcess GetProcessVersion ExpandEnvironmentStringsW InterlockedIncrement InterlockedDecrement ConnectNamedPipe CreateNamedPipeW WaitNamedPipeW DisconnectNamedPipe TlsAlloc

user32

GetWindowTextW SendMessageTimeoutW IsWindowVisible GetWindowThreadProcessId DestroyWindow RegisterClassExA UnregisterClassA CreateWindowExA EnumThreadWindows GetMessageW EnumWindows UnregisterClassW FindWindowW TranslateMessage ShowWindow CreateWindowExW RegisterClassW SendMessageW UpdateWindow DefWindowProcW DispatchMessageW PostQuitMessage

advapi32

RegCloseKey RegOpenKeyExW RegOpenCurrentUser RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryInfoKeyW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation EqualSid IsValidSid GetLengthSid RegCreateKeyW RegEnumValueW RegFlushKey InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSidIdentifierAuthority GetSidSubAuthority OpenThreadToken GetSidSubAuthorityCount CopySid LookupAccountNameW

ole32

CoCreateGuid StringFromGUID2

oleaut32

VariantInit SysFreeString VariantClear