General

  • Target

    C3lery X [by Goddy] V2.zip

  • Size

    9.5MB

  • MD5

    625a77fb98d13223f7cd6445fee6c2c4

  • SHA1

    b8a611145a11597babeafc4a742d5b3026040c85

  • SHA256

    60ecd4c10573d9528a2d64f9b5adcce6d47080a820f8e134623f7ee0e8811db2

  • SHA512

    0e2205cf659293a9092426501d75686f71c81adf3fb609948e4db13df0374bbbb202d9f92b5464f270d7a1a346c028d11e4a24cec0b4bcfa46d03a4e1f46eb34

  • SSDEEP

    196608:2PPUdj5glPpLT4vgma6Wt6G1Ir7VGJBDMsKGFlSNwF/6wBXRQZs3k:CIjKlBL8Z/Qb1I/sVmXwFRQa0

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • C3lery X [by Goddy] V2.zip
    .zip

    Password: SYXRvzDzbxfyBNUD

  • Celery.rar
    .rar

    Password: SYXRvzDzbxfyBNUD

  • Celery/Celery Executor.exe
    .exe windows:4 windows x86 arch:x86

    Password: SYXRvzDzbxfyBNUD

    6e7f9a29f2c85394521a08b9f31f6275


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Bestsellers
  • $INTERNET_CACHE/Byte
  • $INTERNET_CACHE/Cigarette
  • $INTERNET_CACHE/Climbing
  • $INTERNET_CACHE/Colon
  • $INTERNET_CACHE/Comedy
  • $INTERNET_CACHE/Constitutes
  • $INTERNET_CACHE/Cornell
  • $INTERNET_CACHE/Disorders
  • $INTERNET_CACHE/Dt
  • $INTERNET_CACHE/Environment
  • $INTERNET_CACHE/Facial
  • $INTERNET_CACHE/Fine
  • $INTERNET_CACHE/Granted
  • $INTERNET_CACHE/Households
  • $INTERNET_CACHE/Inputs
  • $INTERNET_CACHE/Julian
  • $INTERNET_CACHE/Libraries
  • $INTERNET_CACHE/Liquid
  • $INTERNET_CACHE/Marketing
  • $INTERNET_CACHE/Merger
  • $INTERNET_CACHE/Nano
  • $INTERNET_CACHE/Parent
  • $INTERNET_CACHE/Pending
  • $INTERNET_CACHE/Performance
  • $INTERNET_CACHE/Phoenix
  • $INTERNET_CACHE/Play
  • $INTERNET_CACHE/Prostate
  • $INTERNET_CACHE/Regular
  • $INTERNET_CACHE/Restore
  • $INTERNET_CACHE/Sql
  • $INTERNET_CACHE/Standings
  • $INTERNET_CACHE/Surrounded
  • $INTERNET_CACHE/Tb
  • $INTERNET_CACHE/Termination
  • $INTERNET_CACHE/Twinks
  • $INTERNET_CACHE/Undergraduate
  • $INTERNET_CACHE/Vocational
  • $INTERNET_CACHE/Weblogs
  • Celery/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: SYXRvzDzbxfyBNUD

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/VMProtectSDK32.lib
  • Celery/dll/autoexec/HOW_TO_USE.txt
  • Celery/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: SYXRvzDzbxfyBNUD

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • Celery/dll/celeryuwpver
  • Celery/dll/uwpoff.bin
  • Celery/dll/uwpoffver
  • Celery/dll/uwpversion.txt
  • Celery/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: SYXRvzDzbxfyBNUD

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • README.txt