General

  • Target

    Celery.zip

  • Size

    12.1MB

  • MD5

    0eb92b71b07f0f5335bb7cac791dfbfa

  • SHA1

    952f119649d2dcb1d21b9d5b93a0ec83a643fb0b

  • SHA256

    33e0b1b407c8fc63c718216d34026c60f43dfe76bb04c380a63a585e7f92b228

  • SHA512

    674768880af0b2a34a135cbab0f6c978d91e72f66e7c121dcc18a28fdb055e6e35aec4ef809854a702eac3aa5f53eb7cd80342dab26f92c82303877b6d58ef4f

  • SSDEEP

    196608:nKaXzl19iVODuIpsIajbLlNEkLXOCfcwWNx1q1A3Y2EtrxZNbONaDCWNW+Lmu:KU9iVODuBIa/LlyELIW/bO7wLv

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Celery.zip
    .zip

    Password: infected

  • Celery/Celery V1.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Adventure
  • $INTERNET_CACHE/And
  • $INTERNET_CACHE/Curve
  • $INTERNET_CACHE/Essence
  • $INTERNET_CACHE/Hormone
  • $INTERNET_CACHE/Kinds
  • $INTERNET_CACHE/Medline
  • $INTERNET_CACHE/Occurrence
  • $INTERNET_CACHE/Proprietary
  • $INTERNET_CACHE/Reviewed
  • $INTERNET_CACHE/Rpg
  • $INTERNET_CACHE/Spirituality
  • $INTERNET_CACHE/Tuesday
  • Celery/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/VMProtectSDK32.lib
  • Celery/dll/autoexec/HOW_TO_USE.txt
  • Celery/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/celeryuwpver
  • Celery/dll/uwpoff.bin
  • Celery/dll/uwpoffver
  • Celery/dll/uwpversion.txt
  • Celery/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections