5a9ce6e613360c55e18d082a1279a83bf7a36e1825e4553f8a2672775e8e7b7e

Sharing

Copy URL

Twitter E-mail

General

Target

5a9ce6e613360c55e18d082a1279a83bf7a36e1825e4553f8a2672775e8e7b7e
Size

489KB
MD5

773ddf5b1f3c6aed86f5a6d5e47d6cf0
SHA1

6b78117fdebf7ecd999bed5c80c1eedad38d7307
SHA256

5a9ce6e613360c55e18d082a1279a83bf7a36e1825e4553f8a2672775e8e7b7e
SHA512

b93ffe3295f70b0e6983e2464809586bae36f46057728a1118f0e55ab5aa41e8e8bf598d32075ea6250136332fe3fce2ec62a183d1a549b811bfac44177d1d08
SSDEEP

6144:FSWlP1tI1DrGWRT/jmjHKu8WGr0Y6+hyekgrCyURxacecLJyQjOpkpq5Xgcin2W:F3RIZGsbjmjHK376+CRxaTcFySo5X

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

5a9ce6e613360c55e18d082a1279a83bf7a36e1825e4553f8a2672775e8e7b7e
.dll windows x86

4307af9dbf14b4fa0254e155fff876d5

Code Sign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
lstrcpyW
lstrcmpW
WritePrivateProfileStringW
WinExec
WideCharToMultiByte
TerminateProcess
SearchPathW
OpenProcess
LoadLibraryW
GetWindowsDirectoryW
GetSystemDirectoryW
GetProcAddress
GetPrivateProfileStringW
GetLastError
GetFileAttributesW
GetCurrentProcessId
GetCurrentProcess
GetACP
FreeLibrary
ExpandEnvironmentStringsW
ExitProcess
CloseHandle
Sleep
GetLongPathNameW
GetStartupInfoA
GetModuleHandleA
GetProfileIntA
LoadLibraryA
lstrcatA
GetTempPathA
GlobalUnlock
GlobalLock
GlobalFlags
GlobalFree
GlobalAlloc
GetVersion
GlobalSize
lstrcmpA
VirtualAllocEx
SetErrorMode

user32

DestroyAcceleratorTable
SendMessageCallbackA
OpenWindowStationA
DrawTextA
DlgDirSelectExW
CheckMenuItem
SendNotifyMessageW
EnumDisplayMonitors
TrackPopupMenu
DdeUninitialize
MonitorFromWindow
IMPGetIMEA
ToAscii
GetDesktopWindow
ExitWindowsEx
SendNotifyMessageA
EnumPropsExA
DialogBoxIndirectParamW
SetWindowTextA
SetSystemCursor
SetThreadDesktop
TranslateAcceleratorA
FindWindowW
GetIconInfo
ScrollWindow
EndTask
DdeNameService
wsprintfA
TranslateAccelerator
GetInputState
DdeDisconnectList
SetRectEmpty
BeginDeferWindowPos
BroadcastSystemMessageA
GetClipboardViewer
DrawStateA
CreateWindowExA
GetSystemMenu
ChangeMenuA
DefWindowProcA
PostQuitMessage
RegisterClassA
DdeGetData
DdeCmpStringHandles
DdePostAdvise
LoadCursorA
LoadIconA
ShowWindow
GetMessageA
DispatchMessageA
TranslateMessage
PostMessageA
RegisterWindowMessageA
DdeCreateDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
DdeGetLastError
DdeInitializeA
DdeDisconnect
PeekMessageA

gdi32

GetStockObject
StrokePath
PathToRegion

advapi32

OpenProcessToken
LookupAccountSidW
GetUserNameW
GetTokenInformation
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExA

shell32

SHGetFileInfoA
SHGetMalloc
Shell_NotifyIconW
SHBrowseForFolder
SHGetIconOverlayIndexA
SHEmptyRecycleBinW
SHChangeNotify
ExtractIconA
ExtractIconExW
CommandLineToArgvW
SHGetDiskFreeSpaceA
SHInvokePrinterCommandW
SHGetIconOverlayIndexW
SHGetDiskFreeSpaceExW
DuplicateIcon
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoUninitialize
CoInitialize

shlwapi

StrChrA
StrRChrIA
StrChrW

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4307af9dbf14b4fa0254e155fff876d5

Code Sign

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 251KB - Virtual size: 250KB

.data Size: 19KB - Virtual size: 18KB

.rsrc Size: 162KB - Virtual size: 162KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 251KB - Virtual size: 250KB

.data
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 162KB - Virtual size: 162KB

.reloc
Size: 2KB - Virtual size: 2KB