Overview

overview

10

Static

static

9

by Cel3ry V2.2.1.zip

windows10-2004-x64

1

Celery.rar

windows10-2004-x64

3

Celery/Celery V2.exe

windows10-2004-x64

10

$INTERNET_...essive

windows10-2004-x64

1

$INTERNET_CACHE/Autos

windows10-2004-x64

1

$INTERNET_...rettes

windows10-2004-x64

1

$INTERNET_...lexity

windows10-2004-x64

1

$INTERNET_CACHE/Even

windows10-2004-x64

1

$INTERNET_...Harold

windows10-2004-x64

1

$INTERNET_CACHE/He

windows10-2004-x64

1

$INTERNET_CACHE/Herb

windows10-2004-x64

1

$INTERNET_...ndiana

windows10-2004-x64

1

$INTERNET_CACHE/Kent

windows10-2004-x64

1

$INTERNET_...Option

windows10-2004-x64

1

$INTERNET_...anizer

windows10-2004-x64

1

$INTERNET_...Outlet

windows10-2004-x64

1

$INTERNET_...minder

windows10-2004-x64

1

$INTERNET_...quests

windows10-2004-x64

1

$INTERNET_...mebody

windows10-2004-x64

1

$INTERNET_...Suited

windows10-2004-x64

1

$INTERNET_...Temple

windows10-2004-x64

1

$INTERNET_...lletin

windows10-2004-x64

1

Celery/dll...32.dll

windows10-2004-x64

1

Celery/dll...32.lib

windows10-2004-x64

3

Celery/dll...SE.txt

windows10-2004-x64

1

Celery/dll...wp.dll

windows10-2004-x64

1

Celery/dll...uwpver

windows10-2004-x64

1

Celery/dll/uwpoff.bin

windows10-2004-x64

3

Celery/dll/uwpoffver

windows10-2004-x64

1

Celery/dll...on.txt

windows10-2004-x64

1

Celery/scr...ts.dll

windows10-2004-x64

1

README.txt

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    by Cel3ry V2.2.1.zip

  • Size

    10.1MB

  • Sample

    240420-wqk8daec59

  • MD5

    ba995457ee510b4f55560ba556bbeada

  • SHA1

    312c7468de643b8e146c5ed02867dffcd6bb7f37

  • SHA256

    e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

  • SHA512

    5cad0bc98467b63388dcf875d0a7ada5b592c6d95755be6d5fec9b002b6f75dda6d4e9e6e60149629271a980c2fa2a60d7fdc457e2139bf109cc56a08c49c0a7

  • SSDEEP

    196608:5J2DBByvudpFlcRpeCDWxGzBP7KADoB1UymJ2XRtG1eLqgox74q:vSIvWxcRcVgzJuADoBOkXRoBgJq

Score
10/10
cryptonepacker

Malware Config

Targets

    • Target

      by Cel3ry V2.2.1.zip

    • Size

      10.1MB

    • MD5

      ba995457ee510b4f55560ba556bbeada

    • SHA1

      312c7468de643b8e146c5ed02867dffcd6bb7f37

    • SHA256

      e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

    • SHA512

      5cad0bc98467b63388dcf875d0a7ada5b592c6d95755be6d5fec9b002b6f75dda6d4e9e6e60149629271a980c2fa2a60d7fdc457e2139bf109cc56a08c49c0a7

    • SSDEEP

      196608:5J2DBByvudpFlcRpeCDWxGzBP7KADoB1UymJ2XRtG1eLqgox74q:vSIvWxcRcVgzJuADoBOkXRoBgJq

    Score
    1/10
    behavioral1

    • Target

      Celery.rar

    • Size

      10.1MB

    • MD5

      6a25ad9bba38ea7daa915dab03094ec6

    • SHA1

      8c2c9569f97873a13fee7452aab49750b5537f22

    • SHA256

      b86db6286fa6dad23bc1ba2695707861b25d7ca1f47e15a673897ec8619c4a69

    • SHA512

      74cea880562f6265c24f5e3ea82f9d56edbe04a3151776e7727da3a5984ed458bb87c85f101e40f67599b44b3b5283f1ca6800f550e673e72d9e1d9d0605dba6

    • SSDEEP

      196608:OJ2DBByvudpFlcRpeCDWxGzBP7KADoB1UymJ2XRtG1eLqgox74W:+SIvWxcRcVgzJuADoBOkXRoBgJW

    Score
    3/10
    behavioral2

    • Target

      Celery/Celery V2.exe

    • Size

      287.0MB

    • MD5

      b69b8bbe558142582d2877ad31457857

    • SHA1

      31332c0162acd3da9b53cd5738b3589777ae0fe6

    • SHA256

      d18f26391a2fdd397d1744e999ebed2abf76890afb05b37542cf1565c932a52e

    • SHA512

      49f7b1bad517516b8255ee490755ab3e8497ae458f45617e3131ef5ed0eb7026291aa024c63b55a6a59b0c4d0ce1cfc89a726e42b72380012eca3af95c45d6ef

    • SSDEEP

      24576:WbSqndca7b4b9Be8R00phMRBuTpFNc/GreAVmYq3/Dqaol2afRZ6K0/lPjDPlr9:M5bb4BrRdIi0We1Ydak2apyNPX

    Score
    10/10

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral3

    • Target

      $INTERNET_CACHE/Aggressive

    • Size

      219KB

    • MD5

      9690b2dd473cf209022e3eaa6834806a

    • SHA1

      aa4a2b0bc289762aa4186f5adee3a755958195db

    • SHA256

      f64b3d4e9a90a36ff5d2a9352550ed953462e35321d36735a8afb95e0b652743

    • SHA512

      d0e2b02193390bac25024cc00ca76a7ffb459b0f85cda04143c2ce4fc26681ddafa3e1cc219d15cf2a5805efed067400994ed4927d9920305fee240cf8c73239

    • SSDEEP

      3072:sXqd8x7jHQECBaGZHPe6ueSIqVJuzBE/EV:981j+pZHPevVJuF

    Score
    1/10
    behavioral4

    • Target

      $INTERNET_CACHE/Autos

    • Size

      81KB

    • MD5

      40d2d6e2ffed5fe2edae0937940f545a

    • SHA1

      36651bc47b82c147f982636f14f93e48617d0600

    • SHA256

      9a12748d5a3c6e274f71c000c85353b5ab22a616c7a90b0d712aaf1115ff1fc7

    • SHA512

      62519a5e6450cb498d35545de5863bdf08ba95bbbf72698fbce238819bf2cad26860dfb28bc3c9358916aaccd29f3f2d35443ae8ff324230b8e0335e6fc5824f

    • SSDEEP

      1536:arDWyu0uZo2+9BBVgCOa1ZBPaPQaEwo0yv:IWy4ZNoBVxjCPjojv

    Score
    1/10
    behavioral5

    • Target

      $INTERNET_CACHE/Cigarettes

    • Size

      200KB

    • MD5

      b2dcd8a89d61b67dffe7fab92c86d42b

    • SHA1

      0efd91fad3b3cb742afa16592fd85d78420f7667

    • SHA256

      bbf59ecead28a76e3d3cae7be7cf8505b222fa3abc7fd3f26a2031b99a7db71b

    • SHA512

      83e6675a2562ad411f8dce5cbb616c21817c351b711521fc8402defdcea1b9293639f0fad1c1dd8a5da7e06612993c1eadfb027dbf0e8de4c78779399ee0a7d4

    • SSDEEP

      3072:MAg0FuPOKBNEBNUGXEyaAt7P+6i/xhgariwYLTNh:MAOPOei7TdFW6wgarnYNh

    Score
    1/10
    behavioral6

    • Target

      $INTERNET_CACHE/Complexity

    • Size

      20KB

    • MD5

      e16344b9893a203c54392b9f43982f3d

    • SHA1

      5934d10f6259b42c963b8bf43b845eb42c98fb4e

    • SHA256

      4818e6041c65e51a16de4941b7d499691513e3c22b66d572ad3ffd6f92a631f5

    • SHA512

      60f342a75adf9941091a9d2d829fbc2981b018c7df38aa14c9476e75e313e6b33872b1b6902d8fdf553312f9079ea7853c72a36dbf2b9a50d0765b904c41c6aa

    • SSDEEP

      384:errjw1OeyLN1ENe6aGuvQeFsTbYt9RuMk+QO9Zb4/0bWMvB:qw4sWGuv6crjQAVlvB

    Score
    1/10
    behavioral7

    • Target

      $INTERNET_CACHE/Even

    • Size

      86KB

    • MD5

      cd3c372176e33dd12d36da46754a44c6

    • SHA1

      be5bf24b750c98a39dd8bd1a87afb68040076f1c

    • SHA256

      917f14355ef5af68bfcfb17dda48798e8f7c5bdbc174e8a901168a2c74e50ec9

    • SHA512

      5bd3c0117663211e9de380cafa76525e9f9ff2f1a402eb0f0bbc22c31e70c308e0a4a4be1b8ed769f655eb6aeada0fc484a6afa0e945fa23d2a09c57dc478b66

    • SSDEEP

      1536:J5yiPl/UQ6JP04vDcmrIEVJRa5oQyyk4qt1FqnLUshVkf88nfNk4qqdGYynTDYLC:J5yiPlcQ4NvoWV7a5ouYNqnLzAfaBaGx

    Score
    1/10
    behavioral8

    • Target

      $INTERNET_CACHE/Harold

    • Size

      281KB

    • MD5

      98382177fcb8f94280fe6161dc5bd947

    • SHA1

      5b17b68b1113608ac6813b74bda9a41f96434c18

    • SHA256

      2af18739a52648121ff89f5d5ca440c6a827b2371d808b08827da7555c43bca8

    • SHA512

      5a8f1731eec3b2dc37342644eb450c8fd2d0feba0da2c9d414ace5ef07ff0cc622b1c145b784e69a5befa48a567e874e23490ef09e1e29199e629f0c161e71b4

    • SSDEEP

      6144:Gut5RLpdhP+itn9SxuAkxyhYhdgdqMu2c:nt5RLpdRzR9SxpcyhBCh

    Score
    1/10
    behavioral9

    • Target

      $INTERNET_CACHE/He

    • Size

      137KB

    • MD5

      7328c53b25849bbfaae94346e50f6884

    • SHA1

      def55d4b548414ed80e19f14d9c8f0b000a96009

    • SHA256

      ace16185c0ad1a3b52d91c7f02a956f1f3354266abeb2430cf3db821b570a33b

    • SHA512

      4d02ac36d1a5e0c8f826080492e114a4c59cef5756b938166f9db18a207c40114fbca04efa2d595701c4e5d6b3dc698dbf8db9944765999dd21412cc0084af3c

    • SSDEEP

      3072:Pb2Xo2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZav:Pb2M8JTDD/xcq21R1p/k

    Score
    1/10
    behavioral10

    • Target

      $INTERNET_CACHE/Herb

    • Size

      149KB

    • MD5

      1688119d00c8a5da63a2321e1ca532ce

    • SHA1

      6dfe155dbce255d87e4c06db93ec96d5018ddae2

    • SHA256

      45c5d22a296843ad19409eea019c634cbb25a394ead7698460d79e886a63fcaa

    • SHA512

      84c8685a17fd4438a7f0c9fbc9f6491dd346cc0f70ddbcf0d4fe6bd1356dc2dd7890dc4701d1b0127ceea49fd3b9563e234dfbf577cb93d96cec0f618b48cca9

    • SSDEEP

      3072:oCV26MqgQTc5F446iYNpK5SB7BJBzLZDKJj:oi2VWTyFsJ8gNJBnGj

    Score
    1/10
    behavioral11

    • Target

      $INTERNET_CACHE/Indiana

    • Size

      197B

    • MD5

      ed19ffcfd341f0e04d2e4e6cee02efeb

    • SHA1

      22216f02cb4d146a2c5f207bd4f62934e82a0cac

    • SHA256

      58c2bdb1517566272d4b0ea2e8bcc9b61031fb44b19127c0b5cf9fb1a0739dae

    • SHA512

      291e23d6b993c0a15bc94c1a11770f20ff449b08f1040527a55e2304cdf374d990babdd3bb74c188e63d71b1a587379b7602693eaac299c4758e6a022f69f881

    Score
    1/10
    behavioral12

    • Target

      $INTERNET_CACHE/Kent

    • Size

      248KB

    • MD5

      09a75a7672dacb0212987b5934cc7f69

    • SHA1

      6e2ac25ede8438ca3b2bea01707b87c430099088

    • SHA256

      ac2c44b3e720bbc3df04dd0e2e32497bc7a508f571bf1b54fce19489c982181e

    • SHA512

      090bf2a18e6504d061ca9f3dcfad7e4781fdbbd4840d830d6edd93a05d0cf148be8c9aad21b473f7b301b166898bde2550fc635c0862f7b8d24beb14c9e6342b

    • SSDEEP

      6144:5qKKah8OW0/5zpaOcjzUo39d0l5MBeai5X:I47Ws51a1/Uo3kl6iV

    Score
    1/10
    behavioral13

    • Target

      $INTERNET_CACHE/Option

    • Size

      91KB

    • MD5

      09dbf2c646acb481876674dad686b3cd

    • SHA1

      d12b89c2721390bcce5df81b5e8e2dc11463721c

    • SHA256

      ad09a9f6d2ccc9723227af3320344c9f76fc7c5d26b7ebca4a5fc9402437ed3b

    • SHA512

      36b3057b16a699b795ca5293af49811285d4078380c65ecc7486d961733b5fd6a68375448fee0eeb7235f6e0d94ded5f73d510115719a04de100750cb91cfe95

    • SSDEEP

      1536:aO2NxVQvWPq2FSskcVKNIJ4q7gj2LTpHcewz1mWStIuHWt+72Hr2G2oKwWFHE8FS:aO2rVYj3IXlz+19uHWt+72L2G2Bf68fi

    Score
    1/10
    behavioral14

    • Target

      $INTERNET_CACHE/Organizer

    • Size

      249KB

    • MD5

      6a0bd7dacaedfa73cea2bb32849f2d31

    • SHA1

      a6bea8d93e5d57ac33bdc956e03e3ae4fe05adcb

    • SHA256

      bc547361eef145bd411c033cbd548f9658fac5df197dd051e28e8bc1f39a20ae

    • SHA512

      4867a63f3ccfb47351eefd501f35ae76e3fe7ebc2db4596b8cf0d8a486a87dd92dcc6e8aaab5d4d18bbcd8ec78dd9d51d8e65c1f7f7f8fa708a6c112f32862b3

    • SSDEEP

      3072:I4eFRG+Sc9ec7CImTBI/+aa+IN+8DneFRP+eFRSYJi8WIHnUxY9BHAgZ02IYzO36:Iwa+HuwHYJIcnUm91A2O3KH

    Score
    1/10
    behavioral15

    • Target

      $INTERNET_CACHE/Outlet

    • Size

      260KB

    • MD5

      e1ba0a7e90985597f9b0866b326ce9aa

    • SHA1

      597c113a65c3da1e969b865565a1a7be467c9cbd

    • SHA256

      1c8d829da27fa3eca23d75d187c8dcc4d9c3d146720fe2199b68961015f04475

    • SHA512

      331ff0c786d396b72b28d4b190fecd202590cd5946df1814dc812ba4c3ae08d9b89f8b96b1b27ec6d780b49febbbe3499301fd478725edf07540eb9902dd5fd6

    • SSDEEP

      3072:RwJbxEfaZgu+ZvsXcOJnEyUUIGJ5gW+xGpQ2KglqYd7jF:yJbx9SUXcOlUUIGHgni483F

    Score
    1/10
    behavioral16

    • Target

      $INTERNET_CACHE/Reminder

    • Size

      294KB

    • MD5

      2edcb044c8cf70b6afec411b1cfaf5c8

    • SHA1

      0246bfc0d18924736106dff7a9fc5cf6208a372b

    • SHA256

      2eb96d615b84db034e0dd692aac5f0a239cfda3c44babc7833c2a3e369298f20

    • SHA512

      9c458fd7e410f9950fd52a164a41792faeac5ee2aa13ea43ab74189659925bc1eb4f5288fec543c2d00810001d9ec899c742e508298c07c865881d3244964b9b

    • SSDEEP

      3072:B/WEMhGB7Km6YhNfajPxM59Zq+nKEWkLDN7heTYVi5tyIJvGxY+:BcGJOS93KEWc7rwvGG+

    Score
    1/10
    behavioral17

    • Target

      $INTERNET_CACHE/Requests

    • Size

      151KB

    • MD5

      a6ae575cb7aef7791cf81a60a794c924

    • SHA1

      56cf2a645948461887a4eef5aa00fc2d76b2a343

    • SHA256

      aea55379939f0c1b0690031b64e8338f33c9abaf7ab29ed168338e26e0652d64

    • SHA512

      bbb39599eac28be9ae285db1c8b47c25c73443b0f12e08e425f35fc01cacec65e5467440f437e2314ac8de8a6e4a6a368375f1948ebff8372deecfef5a441661

    • SSDEEP

      3072:epVIa0/vidXqGjLPQ6ClAMfA4lelIJBSLPNG/:e/12vk6AQzyMfA+em

    Score
    1/10
    behavioral18

    • Target

      $INTERNET_CACHE/Somebody

    • Size

      15KB

    • MD5

      7b6406e22b8b8bbd386e1b1108e6ddc9

    • SHA1

      7ef14e132bce74f43a55d5c317205cacfba99c00

    • SHA256

      ef8e05c01549775fdb2fc614f5e07dad510c4573f5c77a26ddd27bcb73417de0

    • SHA512

      ffc4ae959dcf735de00b9f36c19c50757ef6a2d685626122fd17500ae49013ea2b1d22838a0859f685accc1c60bb20c5d5373588cd8d45e209a7ca711b0fc8ff

    • SSDEEP

      192:iZN0Vz8u6vSQD1XbXFPX6WOSWDsN8CC2fmIVVG0jbIUXiZHUXFvCfk+E+YjX80rr:ON063vpRINSlZzVA6LYdOTfJTJ

    Score
    1/10
    behavioral19

    • Target

      $INTERNET_CACHE/Suited

    • Size

      290KB

    • MD5

      3b22ce8417c532e155e553c22bbe2d70

    • SHA1

      b40c477c3b3ce50db14a2e2241a8c4e7b9c38324

    • SHA256

      d5b4ba3e25150ab13cc71def74e12c9d902ed7a87d6faee6818d0d9970c45945

    • SHA512

      30b3fa14df0dac4ae64bb548ff14cf2665b19b912e598d0c4ca0a10255e8d243bb8ab8a08ca9c588eb59b79a21ebf7c6421229650f0ef718374bd3f9b34ea776

    • SSDEEP

      3072:NEG3lcadjxIEitxfUYPDvkLtOWsRuGKfs0Nh6oOOj38mnAUOJqye:NEGtUxfxPDbWsybmDOj38mAtJqye

    Score
    1/10
    behavioral20

    • Target

      $INTERNET_CACHE/Temple

    • Size

      48KB

    • MD5

      0304133398abd9df0b208efbb0b7cf03

    • SHA1

      2b0fe6740cdec064fec627a09119c6adaae71db4

    • SHA256

      b6a8158b0272b83ffd4eefcc0408d89028d916560901195faaf4a8bf3da8df12

    • SHA512

      e2873b2a01845dd161c556252e2cc507fde8f3d09e08471dbd99d87a2cefa06d49330fd03583e2279d27b18dba38e4fde7566fd2da3365212167e25af62518bb

    • SSDEEP

      768:PEx2zinQD2tR/i01A/ES4KY2lfwMwstd7t+Jv/awuUw1Q37iehoxQeU3ecejLixR:Ps2ziQD2tR/i0027EM/awuUwU7KxQef0

    Score
    1/10
    behavioral21

    • Target

      $INTERNET_CACHE/Vbulletin

    • Size

      208KB

    • MD5

      02438f6759aa3e9ee883b24b1f272aa6

    • SHA1

      b78db1e5cc6a6b6a58a4eca200ce53c1668316c6

    • SHA256

      33377b8d3b799487eefeb40b8d9f874cf93516e5dbf1ee67671870178523d512

    • SHA512

      7725b939d04a8891b247d6b60cbed2022ede21ec5452e4092373433f1c6391b374a42f38651af0ddbef4d060b2221ff6c920436127e00df23c7fda74dea7a5cd

    • SSDEEP

      6144:3jGbr885bSwj+Azgbti9ikiwtvhy6vitIgPMC1Ppo:6M85bP+MRhbitUC1Ppo

    Score
    1/10
    behavioral22

    • Target

      Celery/dll/VMProtectSDK32.dll

    • Size

      98KB

    • MD5

      7ff7f1e0cc2bb5a6eac9c21762ee66b2

    • SHA1

      8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5

    • SHA256

      ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074

    • SHA512

      f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9

    • SSDEEP

      1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

    Score
    1/10
    behavioral23

    • Target

      Celery/dll/VMProtectSDK32.lib

    • Size

      7KB

    • MD5

      60558b29db81ad274a8f992882932426

    • SHA1

      eccc072b4fb1bb9204b633be4a6c2d783e71a2a9

    • SHA256

      9278d85fde55f645cafc39946b1832985b85fb6aac23938edf0c6d5ad3027109

    • SHA512

      1b1a6364942309811108b1f1a34e465f0415848d8ec557879c7c4522b13ba594130a224f5055262e1fc8a94aa96c9f5fb037f5a1b1936b2ebf09b3199e358678

    • SSDEEP

      96:UCm/+uYlVlOKU3A/hknkbKJKSKU//DjnK:9VlN/hNyy

    Score
    3/10
    behavioral24

    • Target

      Celery/dll/autoexec/HOW_TO_USE.txt

    • Size

      161B

    • MD5

      4324149d23c0d89f490249e531460c21

    • SHA1

      96a44574a5c71d923e91e6cc3e8a7eb7a9727755

    • SHA256

      a6f1509ddeb9b80f94e3ec9de3821bb129979201c6833f472d25fab16187c1ee

    • SHA512

      c8c49722367d49ffb540cda2ed3fe955027050f810b0e05a501030c2ea5dff44f1a12ccb94c3d982dbadb9f5211ed199cc81d8457fd2821433975261e1c5c82e

    Score
    1/10
    behavioral25

    • Target

      Celery/dll/celeryuwp.bin

    • Size

      4.2MB

    • MD5

      b0f566fc20de341e2848a489f69a4e48

    • SHA1

      7a81ab4c68ddeb1e0a83c37e17286ae53e29c334

    • SHA256

      5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6

    • SHA512

      4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f

    • SSDEEP

      49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ

    Score
    1/10
    behavioral26

    • Target

      Celery/dll/celeryuwpver

    • Size

      3B

    • MD5

      cb5ae17636e975f9bf71ddf5bc542075

    • SHA1

      180505679cfe0cca79bae51fdda0296b7cd9c493

    • SHA256

      14be4b45f18e0d8c67b4f719b5144eee88497e413709d11d85b096d8e2346310

    • SHA512

      957f720b6d516c8e273968c9be2ffbe146329c1a11a2097844206f030dfde1f4efe3379eb68316d1c7426457144d9576dad04e46b10c0ca8d8b9a5d668387a1b

    Score
    1/10
    behavioral27

    • Target

      Celery/dll/uwpoff.bin

    • Size

      5KB

    • MD5

      f6bd9ca8a75d0e07cfd57177cf7bdab3

    • SHA1

      a876290038821ce7ae8d14e3db3286323f22caa7

    • SHA256

      6b1f4c2089b4086bdfd8b11e90721baffe74ddad2240c787e0245e49e93ac332

    • SHA512

      3b1521a404c47c795d2c960bc3edb5e91cc5e598da3c135c16d46b74dd59a0d3dd44c4dc3158f347489b283a7194bf100389cfeb87d8379e6fcc791705fbfb1a

    • SSDEEP

      48:SClA9KbxnWqU6o+MKd2kbcrzQUuPIKtcuMj18SYlt+gtXvsY9W2XApEdF0/JxNyV:nlAkbAeo+BcPNuMuLlhtX7ptv0/H9Cww

    Score
    3/10
    behavioral28

    • Target

      Celery/dll/uwpoffver

    • Size

      3B

    • MD5

      cb5ae17636e975f9bf71ddf5bc542075

    • SHA1

      180505679cfe0cca79bae51fdda0296b7cd9c493

    • SHA256

      14be4b45f18e0d8c67b4f719b5144eee88497e413709d11d85b096d8e2346310

    • SHA512

      957f720b6d516c8e273968c9be2ffbe146329c1a11a2097844206f030dfde1f4efe3379eb68316d1c7426457144d9576dad04e46b10c0ca8d8b9a5d668387a1b

    Score
    1/10
    behavioral29

    • Target

      Celery/dll/uwpversion.txt

    • Size

      5B

    • MD5

      f0016f1d09aea25afcb3fb5948acbb9f

    • SHA1

      5151f95ad805265d9169fb020297c97b589a90cb

    • SHA256

      cc1a4126ba1a738f56187a2a2a9df4f3d3f6baa8dc966feed9d0f6e09a5a486a

    • SHA512

      da19cc04a0a6cc175f056ce4bb5091cb1f7a4efa922704ddedce2aa7dbfda8e53709a81206234744d8ef34c97fd1a31ea0f62ecd41ed7977064dc5ece36477ef

    Score
    1/10
    behavioral30

    • Target

      Celery/scripts/scripts.dll

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    1/10
    behavioral31

    • Target

      README.txt

    • Size

      26B

    • MD5

      6176e513eb6ffdd661947ea8ea142547

    • SHA1

      e0935e3e3c17f398744f21991a8d244418158b38

    • SHA256

      ad1d02c4352d3b45690cb7413a50983c75be3827ea323ad0f16da163f3054b6a

    • SHA512

      aab4ae4bd7a7c4437fdd0c7b6809f11ace8c283411904e674e0978763f95b5693e670b772bc51f2cbaef0c97c6de4222dd8462de3e8042942bc339424e1b6bf2

    Score
    1/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

5
T1082

Query Registry

1
T1012

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks