General

  • Target

    New folder.zip

  • Size

    11.8MB

  • MD5

    749ff673167d610aff8cf606953ce7fc

  • SHA1

    618a4d9e3b90129b0d17825aa80ad8368060bc8f

  • SHA256

    4b1ca5d997da4e08057eceeb090d6157cf35c2a1a959dad693920c1a85749b8c

  • SHA512

    0716ab6f3cb15225396b3f2d64886e703ae935f81c2207433854242d5aa625f91675186385002fd0f709b01d06973cff143e2a1893f59eb5a02e5d1c08c4da4a

  • SSDEEP

    196608:q0lbtJAGewk+Y53DIo5+QVpkephRQdgsk+tdzZ393626yRwcZ93MwadRZec2kAc:qRGe5+YZDIow0pZRQdDdtd33f8gmZdqS

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • New folder.zip
    .zip
  • Solara Eclipce.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Answer
  • $INTERNET_CACHE/Argentina
  • $INTERNET_CACHE/Auckland
  • $INTERNET_CACHE/Breeds
  • $INTERNET_CACHE/Capitol
  • $INTERNET_CACHE/Chart
  • $INTERNET_CACHE/Civilization
  • $INTERNET_CACHE/Cp
  • $INTERNET_CACHE/Delhi
  • $INTERNET_CACHE/Fresh
  • $INTERNET_CACHE/Glad
  • $INTERNET_CACHE/Heard
  • $INTERNET_CACHE/Imposed
  • $INTERNET_CACHE/Incest
  • $INTERNET_CACHE/Interactive
  • $INTERNET_CACHE/Looks
  • $INTERNET_CACHE/Nano
  • $INTERNET_CACHE/Occupations
  • $INTERNET_CACHE/Processed
  • $INTERNET_CACHE/Readers
  • $INTERNET_CACHE/Shepherd
  • $INTERNET_CACHE/Sterling
  • $INTERNET_CACHE/Streets
  • $INTERNET_CACHE/Struct
  • $INTERNET_CACHE/Swiss
  • $INTERNET_CACHE/Theories
  • $INTERNET_CACHE/To
  • $INTERNET_CACHE/Tvs
  • $INTERNET_CACHE/Whether
  • dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • dll/VMProtectSDK32.lib
  • dll/autoexec/HOW_TO_USE.txt
  • dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • dll/celeryuwpver
  • dll/uwpoff.bin
  • dll/uwpoffver
  • dll/uwpversion.txt
  • scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections