Resubmissions

20/04/2024, 02:00

240420-ce2lfade72 10

General

  • Target

    Celery.rar

  • Size

    10.1MB

  • MD5

    6a25ad9bba38ea7daa915dab03094ec6

  • SHA1

    8c2c9569f97873a13fee7452aab49750b5537f22

  • SHA256

    b86db6286fa6dad23bc1ba2695707861b25d7ca1f47e15a673897ec8619c4a69

  • SHA512

    74cea880562f6265c24f5e3ea82f9d56edbe04a3151776e7727da3a5984ed458bb87c85f101e40f67599b44b3b5283f1ca6800f550e673e72d9e1d9d0605dba6

  • SSDEEP

    196608:OJ2DBByvudpFlcRpeCDWxGzBP7KADoB1UymJ2XRtG1eLqgox74W:+SIvWxcRcVgzJuADoBOkXRoBgJW

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Celery.rar
    .rar

    Password: jTePXJTXtNyQimUd

  • Celery/Celery V2.exe
    .exe windows:4 windows x86 arch:x86

    Password: jTePXJTXtNyQimUd

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Aggressive
  • $INTERNET_CACHE/Autos
  • $INTERNET_CACHE/Cigarettes
  • $INTERNET_CACHE/Complexity
  • $INTERNET_CACHE/Even
  • $INTERNET_CACHE/Harold
  • $INTERNET_CACHE/He
  • $INTERNET_CACHE/Herb
  • $INTERNET_CACHE/Indiana
  • $INTERNET_CACHE/Kent
  • $INTERNET_CACHE/Option
  • $INTERNET_CACHE/Organizer
  • $INTERNET_CACHE/Outlet
  • $INTERNET_CACHE/Reminder
  • $INTERNET_CACHE/Requests
  • $INTERNET_CACHE/Somebody
  • $INTERNET_CACHE/Suited
  • $INTERNET_CACHE/Temple
  • $INTERNET_CACHE/Vbulletin
  • Celery/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: jTePXJTXtNyQimUd

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/VMProtectSDK32.lib
  • Celery/dll/autoexec/HOW_TO_USE.txt
  • Celery/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: jTePXJTXtNyQimUd

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/celeryuwpver
  • Celery/dll/uwpoff.bin
  • Celery/dll/uwpoffver
  • Celery/dll/uwpversion.txt
  • Celery/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: jTePXJTXtNyQimUd

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections