f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a

Sharing

Copy URL Twitter E-mail

General

Target
f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a
Size 581KB
Sample220205-j3tdashfar
SHA256 f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a
MD5 0e46dbfab22c5844c4a72412ab09b42c
SHA1 3f5e160e703675cb5e95b8e9dbc85ef61ad08386
SHA512 40afefb607db78b8d998d34bcb89140f95f681238a0def8e7afed1004059b3ca10e21b7997e9f5c8deee0263ea908b78df86228c167fa3ada60d30dd471983b6
SSDEEP 12288:85HdeuPVQN8pRJx1pDTbTbTbTbTbvxKmDEpUy:kK2JLpLxKD
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

File Explorer

f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a

.dll 581KB

f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a

IMPHASH 2a1946ed4f388959fcca1cd7c316b010
SHA256 f00e493560742bfb091591f3bd2dac32fa74de72bd9949e6ad7a0e255193e20a
MD5 0e46dbfab22c5844c4a72412ab09b42c
SHA1 3f5e160e703675cb5e95b8e9dbc85ef61ad08386
SHA512 40afefb607db78b8d998d34bcb89140f95f681238a0def8e7afed1004059b3ca10e21b7997e9f5c8deee0263ea908b78df86228c167fa3ada60d30dd471983b6
SSDEEP 12288:85HdeuPVQN8pRJx1pDTbTbTbTbTbvxKmDEpUy:kK2JLpLxKD
MD5 SHA1 SHA512 SSDEEP

windows x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Minor OS version

Major OS version

Entry point

153440

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue lstrcpyA lstrcmpA WaitForSingleObject VirtualProtect UnmapViewOfFile SuspendThread SleepEx Sleep SizeofResource SetUnhandledExceptionFilter SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetFileAttributesA SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReleaseMutex ReadFile QueryPerformanceFrequency OpenMutexA OpenFileMappingA MulDiv MapViewOfFile LockResource LoadResource LoadLibraryA GlobalUnlock GlobalReAlloc GlobalHandle GlobalLock GlobalFree GlobalFindAtomA GlobalDeleteAtom GlobalAlloc GlobalAddAtomA GetVersionExA GetUserDefaultLCID GetSystemInfo GetStringTypeExA GetShortPathNameW GetShortPathNameA GetLocalTime GetLastError GetFullPathNameW GetFullPathNameA GetFileSize GetExitCodeThread GetEnvironmentVariableA GetDiskFreeSpaceA GetDateFormatA GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfo GetACP FreeResource InterlockedExchange FormatMessageW FormatMessageA FlushInstructionCache FlushFileBuffers FindResourceA FindFirstFileW FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoA DeleteFileA CreateMutexA CreateFileMappingA CreateFileW CreateFileA CreateEventA CompareStringW CompareStringA CloseHandle SetConsoleScreenBufferSize ReadConsoleInputA GetNumberFormatW _lwrite lstrcpynW OpenMutexW GetModuleHandleW DeviceIoControl

user32

GetKeyboardType LoadStringA MessageBoxA CharNextA CreateWindowExW CreateWindowExA WindowFromPoint WinHelpA WaitMessage VkKeyScanW UpdateWindow UnregisterClassW UnregisterClassA UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoA ShowWindow ShowScrollBar ShowOwnedPopups ShowCursor SetWindowsHookExW SetWindowsHookExA SetWindowTextW SetWindowTextA SetWindowPos SetWindowPlacement SetWindowLongW SetWindowLongA SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropA SetParent SetMenuItemInfoW SetMenuItemInfoA SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongA SetCapture SetActiveWindow SendMessageW SendMessageA ScrollWindow ScreenToClient RemovePropA RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageA RegisterClipboardFormatA RegisterClassW RegisterClassA RedrawWindow PtInRect PostQuitMessage PostMessageW PostMessageA PeekMessageA OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjects MessageBeep MapWindowPoints MapVirtualKeyW MapVirtualKeyA LoadStringW LoadKeyboardLayoutA LoadIconA LoadCursorA LoadBitmapA KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageW IsDialogMessageA IsChild InvalidateRect IntersectRect InsertMenuItemA InsertMenuA InflateRect GetWindowThreadProcessId GetWindowTextLengthW GetWindowTextW GetWindowTextA GetWindowRect GetWindowPlacement GetWindowLongW GetWindowLongA GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropA GetParent GetWindow GetMessagePos GetMenuStringW GetMenuStringA GetMenuState GetMenuItemInfoW GetMenuItemInfoA GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetKeyNameTextA GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameW GetClassNameA GetClassInfoW GetClassInfoA GetCapture GetActiveWindow FrameRect FindWindowA FillRect EqualRect EnumWindows EnumThreadWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextW DrawTextA DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageW DispatchMessageA DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefWindowProcA DefMDIChildProcA DefFrameProcA CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CallWindowProcW CallWindowProcA CallNextHookEx BeginPaint CharLowerBuffA CharLowerA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout SetProcessWindowStation DdeUninitialize GetMenuDefaultItem TabbedTextOutW EnumDesktopsW LoadImageW DeferWindowPos UnloadKeyboardLayout CreateDesktopW EndMenu wvsprintfA SetClassWord RealGetWindowClass GetClipboardFormatNameA DdeDisconnectList GetClassLongA DdeInitializeW IsMenu InSendMessage GetAsyncKeyState GetClipboardOwner CopyIcon GetMenuCheckMarkDimensions GetDlgCtrlID GetCaretBlinkTime OemKeyScan OpenIcon GetListBoxInfo IsCharAlphaW CloseWindow GetKBCodePage PaintDesktop

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RestoreDC Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPointA GetTextExtentPoint32W GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits ExtTextOutA ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectA CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA BitBlt HT_Get8BPPMaskPalette GetStringBitmapW GdiGetLocalBrush GetICMProfileW SetVirtualResolution ExtCreatePen GetLogColorSpaceA CreateDCA GetNearestPaletteIndex SelectBrushLocal WidenPath GetTextExtentPointW EnumICMProfilesW GetColorAdjustment GetViewportExtEx GetOutlineTextMetricsA SetColorSpace EngCreateDeviceBitmap PtVisible SetDCPenColor GetTextExtentExPointWPri GdiPlayJournal CreateEllipticRgn EngStretchBltROP GdiConvertAndCheckDC GetTextColor PathToRegion CloseEnhMetaFile GetTextCharacterExtra GetColorSpace GetBkColor EndPage GetTextCharset GdiFlush StrokePath

comdlg32

GetOpenFileNameW GetOpenFileNameA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey SetSecurityDescriptorDacl RegSetValueExA RegFlushKey RegCreateKeyExA InitializeSecurityDescriptor

shell32

Shell_NotifyIconA FindExecutableA SHBrowseForFolder ShellHookProc ShellAboutW SHFileOperation SHPathPrepareForWriteA DoEnvironmentSubstW SHCreateDirectoryExW SHEmptyRecycleBinW SHGetInstanceExplorer SHAppBarMessage SHBrowseForFolderA DragQueryFileA SHFreeNameMappings SHGetMalloc

ole32

CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoUninitialize CoInitialize IsEqualGUID

shlwapi

StrRChrIA StrChrA StrStrW StrCmpNA StrRStrIA StrStrIA

comctl32

ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_GetImageCount ImageList_Destroy ImageList_Create ord17