r77 | 24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d

Sharing

Copy URL Twitter E-mail

General

Target
24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d
Size 986KB
Sample260922-c5k2dadh69
SHA256 24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d
MD5 58ffaa7ce2ef32f7fa0e757860076e97
SHA1 4f4edecb60a6a1b21256087d5063deec17fd17e3
SHA512 150e2e4eb326d907a788b7a50715d0269b1baa01f9b32b052ba5516a88cdf4542b594041473f0e2bcdeb909a17d29a43b7e2e3823649cf5cac685e7a81f6502f
SSDEEP 24576:Ei1KGNlmZ08q4YA36sus2qjFQgWJ6978KDogzz5ydm0Oe:E1GNtfMFbQJ5Izo0De
TLSH
T18B2533F917A631498705FF75C973AC42FAF25D946803DBA884A831E441E33BD88AFD84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit r77

Malware Config

Signatures

Family: r77
r77 is an open-source, userland rootkit.
rootkit r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
static1/unpack001/The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe	r77_payload

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

File Explorer

24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d

.zip 986KB
The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

.exe 1.6MB

24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d

SHA256 24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d
MD5 58ffaa7ce2ef32f7fa0e757860076e97
SHA1 4f4edecb60a6a1b21256087d5063deec17fd17e3
SHA512 150e2e4eb326d907a788b7a50715d0269b1baa01f9b32b052ba5516a88cdf4542b594041473f0e2bcdeb909a17d29a43b7e2e3823649cf5cac685e7a81f6502f
SSDEEP 24576:Ei1KGNlmZ08q4YA36sus2qjFQgWJ6978KDogzz5ydm0Oe:E1GNtfMFbQJ5Izo0De
TLSH
T18B2533F917A631498705FF75C973AC42FAF25D946803DBA884A831E441E33BD88AFD84
MD5 SHA1 SHA512 SSDEEP TLSH

The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

IMPHASH 3d87e274a0ba20acf283bc97580ad40d
SHA256 60ada17e1371efeff3a16a56bf33979d8278013f3550b501dc082bbbd47961eb
MD5 76cae34ebfb7cd5a56a09888f4132748
SHA1 1c2f611d193a53b0f27ff1f9c1f215bcdfe943a7
SHA512 04a883435877337cb8e79ac8bd45d59ecc41376b7523dd7c05bf3ef4dddc10144c1c0646cb6a493df1d19f5c5b44cb1c329be96eea0ed9c50a9f1064be9091d8
SSDEEP 24576:YfMvGbO+IGoP/ENWuDZ28y/BiEF9hLHDSZ/WJ65bJ7mcx:eM4O5LP/EEL5JiUNJAV7mcx
TLSH
T165759C1A77A404F9E0779179C9938946E7F278061B71CBDF07A0436B2F277A18E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

r77 rootkit payload

Detects the payload of the r77 rootkit.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcessId GetTempPathW CreateDirectoryW LoadLibraryW GetProcAddress WaitNamedPipeW GetLastError CreateFileW ReadFile WriteFile GetModuleHandleA LoadLibraryA GetPrivateProfileStringW WritePrivateProfileStringW GetModuleHandleW FindResourceW LoadResource Sleep LockResource GetFileAttributesW GetModuleFileNameW LoadLibraryExW FreeLibrary MultiByteToWideChar GetCurrentProcess IsWow64Process SetLastError ResumeThread WaitForSingleObject LocalFree WriteConsoleW HeapSize MapViewOfFile CreateFileMappingW UnmapViewOfFile SizeofResource CloseHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetStdHandle GetFullPathNameW GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WideCharToMultiByte GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer QueryPerformanceCounter InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader RaiseException GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW ExitThread GetStdHandle HeapFree HeapAlloc SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode

user32

MessageBoxA MessageBoxW

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy

mscoree

CorBindToRuntime CLRCreateInstance

wininet

InternetReadFile InternetOpenUrlA InternetOpenA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW

Name

.text

Size

483KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

933KB

Virtual Size

932KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

24a88e59bff9c9335373385d6f66d07f3c78b626cc44bec785fa2b64bde65e6d

The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

kernel32

user32

advapi32

shell32

oleaut32

mscoree

wininet

version

winmm

generic