f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83

Sharing

Copy URL

Twitter E-mail

General

Target

f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83
Size

248KB
MD5

968aa71bc85acbe80fd6021680d2247d
SHA1

dddb690db20ef641582968d93e4963270d946c56
SHA256

f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83
SHA512

fdf5e5fe5a17127f8d2ca653aecf83f9745e8872890b84736b25106befb4a69d151aa6059f40a3626ae1a063060827b2ffeeb0a18fef13c96bdb04c7dd8763d3
SSDEEP

6144:UYAUWh6S9N95hQDku5CFfqxqJsZttcSZtl3:U6IX2MQqqZttdZtB

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Files

f9b6a3aa9f190358be763f5bc08a44a8eb7d5412b3ac3eb0490e919d9e1fca83
.exe windows x86

54e865e60a8f78ac04d57e4b36bb7d88

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strcat
strcmp
free
_except_handler3
strrchr
rename
_iob
atoi
_errno
wcscpy
strtok
vsprintf
strncat
memset
rand
_beginthreadex
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
malloc
strcpy
memcmp
strlen
_ftol
memmove
_CxxThrowException
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
calloc
_strupr

ws2_32

getpeername
bind
getsockname
inet_addr
inet_ntoa
recv
send
select
closesocket
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSACleanup
accept
listen
WSAStartup
sendto
gethostname
__WSAFDIsSet

msvcp60

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

kernel32

GetProcessHeap
CreateEventA
GetLocalTime
Sleep
GlobalFree
WriteFile
RemoveDirectoryA
LocalAlloc
GetDriveTypeA
OutputDebugStringA
ReleaseMutex
lstrcmpA
SetErrorMode
GetModuleHandleA
GetStartupInfoA
CreateProcessA
CreateDirectoryA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetPrivateProfileSectionNamesA
SetEvent
lstrcpyA
VirtualAlloc
VirtualFree
CloseHandle
LoadLibraryA
GetProcAddress

user32

PostMessageA
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
GetSystemMetrics
OpenClipboard
SetClipboardData
GetThreadDesktop
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
CharNextA
IsWindowVisible
GetWindowThreadProcessId
LoadCursorA
GetCursorPos
SetRect
ReleaseDC
CloseClipboard

advapi32

RegOpenKeyExA
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyA
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LookupAccountSidA
GetTokenInformation

gdi32

CreateDIBSection
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
DeleteDC
DeleteObject

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

Sections

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54e865e60a8f78ac04d57e4b36bb7d88

Headers

File Characteristics

Imports

msvcrt

ws2_32

msvcp60

kernel32

user32

advapi32

gdi32

shell32

msvfw32

Sections

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 156KB - Virtual size: 157KB

.rsrc Size: 76KB - Virtual size: 76KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 156KB - Virtual size: 157KB

.rsrc
Size: 76KB - Virtual size: 76KB