General

  • Target

    by Cel3ry.zip

  • Size

    8.7MB

  • MD5

    ad4bf23f0e0a88d8044cc5ea51f48c57

  • SHA1

    ff1e144e29d24168588f15e3c480b5a30a6cf292

  • SHA256

    13bdf033b658e6e5d2e84ad32c79652c842942f2b876470f64c8b1995cd16517

  • SHA512

    9980f0ff8b1ebd35c62d6c12d4135bc2a61e011855b23d46f594f573cf1dda34c6aa557a1d55aebda4818e02dd737df3d56292489426ec76d55418e6735bd9e0

  • SSDEEP

    196608:Pf6hzozHACMAM1Cbiwo4TbluHoDvpu/t3v+ywptd+8w:nv8uFTBMoDxy3snd7w

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • by Cel3ry.zip
    .zip

    Password: mlwiLAbvuKtBJMBc

  • CeleryX.rar
    .rar

    Password: mlwiLAbvuKtBJMBc

  • CeleryX/Celery X.exe
    .exe windows:6 windows x86 arch:x86

    Password: mlwiLAbvuKtBJMBc

    28d5eb0c51666da2407c189d41fe50b1


    Headers

    Imports

    Sections

  • CeleryX/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: mlwiLAbvuKtBJMBc

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • CeleryX/dll/VMProtectSDK32.lib
  • CeleryX/dll/autoexec/HOW_TO_USE.txt
  • CeleryX/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: mlwiLAbvuKtBJMBc

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • CeleryX/dll/celeryuwpver
  • CeleryX/dll/uwpoff.bin
  • CeleryX/dll/uwpoffver
  • CeleryX/dll/uwpversion.txt
  • CeleryX/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: mlwiLAbvuKtBJMBc

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • README.txt