Static task
static1
Behavioral task
behavioral1
Sample
cryptcat/cryptcat.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cryptcat/cryptcat.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
cryptcat/mynet.bat
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
cryptcat/mynet.bat
Resource
win10v2004-20231215-en
General
-
Target
2ed6af877c55f231ce0db3725c9e689f
-
Size
115KB
-
MD5
2ed6af877c55f231ce0db3725c9e689f
-
SHA1
4670dc26e9f5a0a87406f337fcf5e543cdf56ce7
-
SHA256
6a9df9ba11c343edb25057c8db5eef82ab613dc64395d5bb4c5b55531c45b165
-
SHA512
90364e95caea7a40b9c68454d4bc8a047fc113b1c46aba42fb2ce16dd1424e6a8353e55a88dd5c592a2bdc3b86dfd4e84b9296b4c500d2ba3d72ec389a26857d
-
SSDEEP
3072:RDJ2iwU9dRBFhiIlbakcG7Q8CZWlqrQz8T42OV1v:mR0ZiI9akchRZPT4/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cryptcat/cryptcat.exe
Files
-
2ed6af877c55f231ce0db3725c9e689f.zip
-
cryptcat/NETCAT.C
-
cryptcat/README.cryptcat
-
cryptcat/cryptcat.dsp
-
cryptcat/cryptcat.exe.exe windows:4 windows x86 arch:x86
bbafcbefe868aac780ce77332f38d34e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
GetLastError
CreateThread
CreatePipe
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
GetStdHandle
FreeConsole
VirtualAlloc
VirtualFree
SetEndOfFile
CreateFileA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
LCMapStringW
LCMapStringA
LoadLibraryA
GetProcAddress
SetStdHandle
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetEnvironmentStringsW
HeapFree
HeapAlloc
CloseHandle
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
FlushFileBuffers
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
ws2_32
__WSAFDIsSet
select
send
listen
getsockname
recvfrom
accept
WSASetLastError
socket
setsockopt
bind
connect
htons
getservbyport
ntohs
getservbyname
inet_addr
gethostbyname
inet_ntoa
gethostbyaddr
WSAGetLastError
WSAStartup
WSACleanup
recv
closesocket
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
cryptcat/doexec.c
-
cryptcat/farm9 Public License Agreement.txt
-
cryptcat/farm9 README.txt
-
cryptcat/farm9crypt.cpp
-
cryptcat/farm9crypt.h
-
cryptcat/generic.h
-
cryptcat/getopt.c
-
cryptcat/getopt.h
-
cryptcat/hobbit.txt
-
cryptcat/makefile
-
cryptcat/mynet.bat
-
cryptcat/readme.txt
-
cryptcat/twofish2.cpp
-
cryptcat/twofish2.h