General

  • Target

    BETA Ex3cutor [by ryosx] ByfronBypass.zip

  • Size

    9.5MB

  • MD5

    7aa0295f329b0748434c673d0f04a707

  • SHA1

    12dea3092c00d8e8212f133e1cf47ba30403baf6

  • SHA256

    ed26db0da7361601cfab62429672a35be01ad8579f9ad6ba004442c6942d07ee

  • SHA512

    f867db7abb136a552ab3f161722bdea8203f2039a367b1af9922965eac5caed992b8032666500c15c06bef53f89615565b87abfd799be64a1acbd2423e5f8644

  • SSDEEP

    196608:IY0XaSXkMTB+zyGJtU6z8kAkNPSUJDkoe6/iFeTB1wbRJGH:7EadyAtU6YkAkNReoeDE1wrM

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • BETA Ex3cutor [by ryosx] ByfronBypass.zip
    .zip

    Password: W3EjwlDN1

  • BETA.rar
    .rar

    Password: W3EjwlDN1

  • BETA/BETA Executor V3.1.exe
    .exe windows:5 windows x86 arch:x86

    Password: W3EjwlDN1

    003a54a0fe3c2a4dbf64143004ff22d3


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Arm
  • $INTERNET_CACHE/Birds
  • $INTERNET_CACHE/Blow
  • $INTERNET_CACHE/Brands
  • $INTERNET_CACHE/Cnetcom
  • $INTERNET_CACHE/Constant
  • $INTERNET_CACHE/Coordination
  • $INTERNET_CACHE/Director
  • $INTERNET_CACHE/Em
  • $INTERNET_CACHE/Eos
  • $INTERNET_CACHE/Follows
  • $INTERNET_CACHE/Ghana
  • $INTERNET_CACHE/Inns
  • $INTERNET_CACHE/Jesse
  • $INTERNET_CACHE/Laid
  • $INTERNET_CACHE/Metro
  • $INTERNET_CACHE/Prison
  • $INTERNET_CACHE/Providence
  • $INTERNET_CACHE/Quite
  • $INTERNET_CACHE/Rome
  • $INTERNET_CACHE/Sharon
  • $INTERNET_CACHE/Showers
  • $INTERNET_CACHE/Sigma
  • $INTERNET_CACHE/Singh
  • $INTERNET_CACHE/Smtp
  • $INTERNET_CACHE/Submission
  • $INTERNET_CACHE/Task
  • $INTERNET_CACHE/Viagra
  • $INTERNET_CACHE/Viruses
  • BETA/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: W3EjwlDN1

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • BETA/dll/VMProtectSDK32.lib
  • BETA/dll/autoexec/HOW_TO_USE.txt
  • BETA/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: W3EjwlDN1

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • BETA/dll/celeryuwpver
  • BETA/dll/uwpoff.bin
  • BETA/dll/uwpoffver
  • BETA/dll/uwpversion.txt
  • BETA/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: W3EjwlDN1

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • README.txt