��X%�X�1�u� ��Q�(A�7\+H{2��lV�o}�QN���D3���,��!�c���tJ^t8�\ܑ?0hiP��pg�@�Qt�'��sgA$]6�2�k�d�:���,���'�u�śՁL R{�ځ�a�EǺi�N�L���砠˸>hn ����>����̣1h[��>�&V�3�B�����@�v��f��f�}��#��L��o����C �$��\Z�vlPS�s��������M%���8� iN&������4@Y�1Q��>��]GN��k���p�b}f��SC͌��9r���gFt��.k0q8�L��� kd�6�t�F�ާ�&Wܤ+6�XY��Yy#�� YN���o ��K:�n;���T�����/t��gj-����{8�f�R}���������=d��Cz� Y8�פY��NP�`ۢnd~!�5�d6���-nhb�y?[�7 Qy919L�����8J��,���[%�u9�Zr�T��GhR�ˀ�?ڌ����e�y�]�Ӄ��#��*Q������2�m��3�=���Ԫ9� ���ˮ�s�̋Eۍ�Hol�)�40�������&E۵` �:��M>Y��ӿv�Jt��Bp���p�1=�e��� ���x'_Eұ뚜S�����"˦�>����Ç�}\V�1�g����B�y��O�hf�����,��"� �,����lq��Y+�K���26�%x���:�JSq%�/14�df���3�� ����)=j����;�Ij�⎸���=~���_2���/�HQ��ec^�7'�yܾ��� ����/�mĶ.����a8f��QKQ��i�\uJ ��~���s"t�_��ȡ�(�~��e1^[ܽe*������,)9 �����D��Z�lo����C$�b��@�S�o�� � G`Ч��0 _H��ʬ��a�_?T%)U:��L�p���d2eaNP�����B�x����IW����c$�G+`Q߄Q^Fe�tH��\����]IoD�>��ct̝9�9Ԓ��(;�@�%��:2U����r��� ���� �1Ȳ�xm�{�%{ߟA�4p�B9t�n�{��e�FAj�2a��"6�������=�sN��kE ��`�nUG��e�������;�ԭ��(V ��Ӽ�� ���Ks��q�pٻ��g�-#,�[�F�*��0H��d)lV�)�� P��R�b���D����N"�l���i�ה��^��*)�w�3 O�G����|�w���s�=���|��7ܦw��(�#KZ�`�$���U�T��&�<U���$Uv4}e���,��O�����a�e%��G�@xw������*���7O(�y�p���#���`t�����=�bu�7��X�.�kLt���s߽�H@����H?/�BbmVa�������c"��9-��C��h>�ޜ�0�\� �<�x:9Y������U.CN� ��F��������E&�([��b4��.Z��z�ִ5*�k���?׆�Ma@?R��%Z�e_egAg%�����\�>�|��{����I��ɭbP�E�f�!P��V�����b��Lه���A�D��VzxJ`��T��>E��[�ΑQ;Bx��<������E�y����v-;�����s� ����F.7o�2!�Q�N�X�9�k����Z��Atl@V8�����f��t�� ^� ���kʹ)���.����P�gd�B���E�mp�<X�Z!��b֧����k\P�C�>V�U�6ğ����E".���Xm�>�j���s[T��^iT�w{��Zo-��y��`�`�W��,zO��FL��P�z�i�s����4�E�B�0�����2(R�-L��1��P=�5�.�N�Q{���GwwH�K�H Tt����z��S�����_w�_�Yn�p���}��?ZR�q� X�j�r����aE5�nGl=�M+n�L��hx��b�ȝb��L��>��F=`�#^�����^��'�1��{0�.���e�/��ո��{�V�#~ [;* V�ʝE�D9�L��2Y���a͋l��6�L��Po���?H������\�:o���GV��M��8�����ʰ�{�UN;�:��+J�4����]M�D�����5�np俨FyXF���Er����ʜ5en/���o����\L����PyV'2���p�`v�T��x�T���t?P2qe�8�b�+�D���^H���@�ez@���"����I�:t �Ÿj�a���䟚�^?y�n;��j�"֝d �/=� �ի+Ӌ{���F�@e9���ʇy�#���Rh���!����gi��9��{��W�S�@�j(������N�Q��ӑ�9��y+�D�#:�Z�-_���a+8��{�B'4`�ղv��.�}�L��4��<M%��RwcMI�]���ؤ{�P ���]�#61a����٩l�5u���حr9�>�'b&i4�څXa?HaN�H�`��<ۍ:{�)���*�_�T�>v�߂���洝���T��r��&�_Y9\N�?s1�*�@@e��]�{��e]��=piP�q�b�Ci����4V��#c�E��K�M*��I� 5X�:����nj;+% 3�i�=Бj��<��^�3�Xy��]܄Ɍ�rѠ�X䥒�������#Ғ���'y�i@�Z�"M�]B[Uj\S|�� ��/H[����7��I�F�L����`��f�1 W�`&�(��H�a�2+����!�ɯ)�!�b��L?1nz���N��̥u�>yW �ٟ��k O<��H��O����!�L�@ �D� ȏ��ƚ�u|�p:�9-,C��Lid��vT5��$xl���p����up6�F5�Z�`�������*���"s*a����[��)K���ƪxq�ff�L��ç", `�YU���ҩoz�D�n� �Y4��Z�>�;`Q��ٕ=��^�E�IV�W�i��#B({�_�7��� C��25d�V\�f6� �\uE!��_N���5�*fi�h�1Đ�`_�wz��.c�ʼn\}CC����B���*�eo�T-Bfl��gN%��\�z����"�ͱ����E�R,R����������GӀ��3U�p:7�߇�;�y펖$�<������GO��� %�E�woN�����p��|4��~�Fr���A��O��m��⛧��U|3Bg �< Wow�<-Zz( F��H$��;/.�#�1�$5*w����\ ��j9S�V����l<�C�����9o
Static task
static1
Behavioral task
behavioral1
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral2
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter_By Vidhayakji786.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/Krakenz.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/MaterialSkin.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/Newtonsoft.Json.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
Karken Cryper By The Hacker Error/Lovely Crypter/Update.exe
Resource
win10v2004-20230703-en
General
-
Target
Karken Cryper By The Hacker Error.zip
-
Size
8.9MB
-
MD5
c859e0b18b09115a65b8d98fe4ee309e
-
SHA1
dcd5571dccab55610f5d22ad3cf35a4224a8a579
-
SHA256
6b9870ee7a172a6325939c42b8d01b7130b902a7ca76e60915a1590f8b5ccde0
-
SHA512
4897ef6bbe9778ffda78b5cd942840921b5f3d7d89f324042a12fc2d2d834653b6fe3f40ec625ea3a97bcbf5239905154b819a412a648a2f6c509b64fadc754b
-
SSDEEP
196608:32zEBp+k3Wmyz+OaKBGnua400R3/GF8GLfz4FBMx+FsfdnsSG5pBcV5+:32zEPJ3i+O9BWuPIfz4FBGRdnHRk
Malware Config
Signatures
-
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter.exe.bck unpack001/Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter_By Vidhayakji786.exe unpack001/Karken Cryper By The Hacker Error/Lovely Crypter/Krakenz.dll unpack001/Karken Cryper By The Hacker Error/Lovely Crypter/MaterialSkin.dll unpack001/Karken Cryper By The Hacker Error/Lovely Crypter/Update.exe
Files
-
Karken Cryper By The Hacker Error.zip.zip
-
Karken Cryper By The Hacker Error/@The_HACKER_ERROR.txt
-
Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter.exe.bck.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 2.1MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Karken Cryper By The Hacker Error/Lovely Crypter/KrakenCrypter_By Vidhayakji786.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karken Cryper By The Hacker Error/Lovely Crypter/Krakenz.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karken Cryper By The Hacker Error/Lovely Crypter/MaterialSkin.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karken Cryper By The Hacker Error/Lovely Crypter/Newtonsoft.Json.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2031, 00:00SubjectCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23Certificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before27/04/2018, 12:41Not After27/04/2028, 12:41SubjectCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7eCertificate
IssuerCN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=USNot Before25/10/2018, 00:00Not After29/10/2021, 12:00SubjectSERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/01/2021, 00:00Not After06/01/2031, 00:00SubjectCN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10Signer
Actual PE Digest2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 675KB - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Karken Cryper By The Hacker Error/Lovely Crypter/Update.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ