Overview

overview

10

Static

static

10

infected.zip

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    infected.zip

  • Size

    11.4MB

  • MD5

    20378da4066af3d5b0ac9f0d6879e752

  • SHA1

    b6486b33e22c02ee93d32200f2f4f4dbb2dcc08d

  • SHA256

    c7d5c2d7df032671544a0974fb292e2131b541469ef1daf9c103c1a534a8ee60

  • SHA512

    9cc56049ab71c2df9f41f9faa5b30848d33721d1911bca2190ed2a0fae4e54ff959568362a0f0769f985660cab7035816e8cebc30ae35997238b07c671510a31

  • SSDEEP

    196608:W/yaLXILj6fFsb16m9kGRii2BSe2qE3LsGqjRGPnosvg93p9N0MY/6FGD2TDY:W/fSj0ebv2G2MJqE389GPnPvgb0Mz4Z

Score
10/10
cryptonepackerupxmimikatz

Malware Config

Signatures

  • Mimikatz family
    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 2 IoCs
  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • infected.zip
    .zip
  • Bin/Cache/Install.dat
    .exe windows x86

    de6942886ea1706308de6a5dc748b51c


    Headers

    Imports

    Sections

  • Bin/Client.exe
    .exe windows x86

    2643ef4c14928c571eff5f816b207fa7


    Headers

    Imports

    Sections

  • Bin/Client.ini
  • Bin/Plugins/Baidu.html
    .html .js
  • Bin/Plugins/BaiduE.html
    .html
  • Bin/Plugins/Gaode.html
    .js
  • Bin/Plugins/GaodeE.html
    .html
  • Bin/Plugins/GetPswd32.exe
    .exe windows x86

    91c58525e2b08a41627faf84ecb6c4cc


    Code Sign

    Headers

    Imports

    Sections

  • Bin/Plugins/GetPswd64.exe
    .exe windows x64

    66ee036df5fc1004d9ed5e9a94a1086a


    Code Sign

    Headers

    Imports

    Sections

  • Bin/Plugins/IPUpdate.exe
    .exe windows x86

    77f2a6b3e475e55480b0129029e9b348


    Headers

    Imports

    Exports

    Sections

  • Bin/Plugins/PcLock.exe
    .exe windows x86


    Headers

    Sections

  • Bin/Plugins/ShellCode.bat
  • Bin/Plugins/ShellCode.exe
    .exe windows x86

    09ca14b770874b1f2a5bf00d50fdc36b


    Headers

    Imports

    Sections

  • Bin/Plugins/SkinH.dll
    .exe windows x86

    9913b440c3d28720bd3a56580eb5dafb


    Headers

    Imports

    Sections

  • Bin/Plugins/bPluginVideo.dll
  • Bin/Plugins/mstscax.dll
    .dll regsvr32 windows x86

    f4f9ea2971d7855283ab7cbcf0ce7925


    Headers

    Imports

    Exports

    Sections

  • Bin/Plugins/qqwry.dat
  • Bin/Plugins/termsrv_t.dll
    .dll windows x86

    38242edcd70d38c5abcf4713d30126aa


    Headers

    Imports

    Exports

    Sections

  • Bin/SkinH.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • Bin/Skins/SkinH.she
  • Bin/Skins/homestead.she
  • Bin/Skins/itunes.she
  • Bin/Skins/niceblack.she
  • Bin/Skins/pixos.she
  • Bin/Skins/qqplayer.she
  • Bin/Skins/royale.she
  • Bin/Skins/xmp.she
  • Bin/rasadhlp.dll
    .dll windows x86


    Headers

    Exports

    Sections