General

  • Target

    Celery.rar

  • Size

    11.0MB

  • MD5

    e1b1dde243f94f97aed7982472c52139

  • SHA1

    c3924d65b431b82c884af88069dbca97f5337647

  • SHA256

    26d366f6cb1e81df0d368d89a94b4a5e31afff2b5585fc7f04fe5f458a3363a5

  • SHA512

    d9ff0242a2dff2c3e762b2797b925575e325a66f7d3dae1cb86833f2c94932baeafa8b51dac841878c9683b140ab8b716ff7586b6dbd45f456e2567029a1bc57

  • SSDEEP

    196608:plbJNblXDvkBmYI/wztgl60Vh/CbzuswVHIu9HACc9QHuLquKPDA3ZUv2uc:pXNblzMUYaCu4bCsEITCF5U3ZUvG

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Celery.rar
    .rar
  • Celery/Celery V5.exe
    .exe windows:6 windows x86 arch:x86

    b435c235420dc9fc090ba038dbbad3b1


    Headers

    Imports

    Sections

  • Celery/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/VMProtectSDK32.lib
  • Celery/dll/autoexec/HOW_TO_USE.txt
  • Celery/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/celeryuwpver
  • Celery/dll/uwpoff.bin
  • Celery/dll/uwpoffver
  • Celery/dll/uwpversion.txt
  • Celery/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections