General

  • Target

    UpdaterSxlxra V3,5 PC [ryosx.cc].zip

  • Size

    9.8MB

  • MD5

    aa3150d003aa763ce9f132d9940ed1e3

  • SHA1

    7d9f7b5419e0143200e669ac85151c3b60a409e0

  • SHA256

    4687a61c0389114888ef59bd62891d2eab137302546ec7f13d256c2eaec271e4

  • SHA512

    208fb8811cb0574e7014682e807b150afc868b9307aa4ad997e78e0c318afc7f03a9294e930e8e73dde8c5b4788ee77024854f500c7011f408415d037d063096

  • SSDEEP

    196608:4ADorByBY6SKboawvhkGK+jHCrWkSt/vm4G0Q+gB8+aWRsnEa8/:44gKY6SbaEhkGZG6kY/uXV5B8+aW+Ef/

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • UpdaterSxlxra V3,5 PC [ryosx.cc].zip
    .zip

    Password: 3HVlmmpu

  • README.txt
  • UpdaterSolara.rar
    .rar

    Password: 3HVlmmpu

  • Updater Solara.exe
    .exe windows:4 windows x86 arch:x86

    Password: 3HVlmmpu

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Answer
  • $INTERNET_CACHE/Argentina
  • $INTERNET_CACHE/Auckland
  • $INTERNET_CACHE/Breeds
  • $INTERNET_CACHE/Capitol
  • $INTERNET_CACHE/Chart
  • $INTERNET_CACHE/Civilization
  • $INTERNET_CACHE/Cp
  • $INTERNET_CACHE/Delhi
  • $INTERNET_CACHE/Fresh
  • $INTERNET_CACHE/Glad
  • $INTERNET_CACHE/Heard
  • $INTERNET_CACHE/Imposed
  • $INTERNET_CACHE/Incest
  • $INTERNET_CACHE/Interactive
  • $INTERNET_CACHE/Looks
  • $INTERNET_CACHE/Nano
  • $INTERNET_CACHE/Occupations
  • $INTERNET_CACHE/Processed
  • $INTERNET_CACHE/Readers
  • $INTERNET_CACHE/Shepherd
  • $INTERNET_CACHE/Sterling
  • $INTERNET_CACHE/Streets
  • $INTERNET_CACHE/Struct
  • $INTERNET_CACHE/Swiss
  • $INTERNET_CACHE/Theories
  • $INTERNET_CACHE/To
  • $INTERNET_CACHE/Tvs
  • $INTERNET_CACHE/Whether
  • dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: 3HVlmmpu

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • dll/VMProtectSDK32.lib
  • dll/autoexec/HOW_TO_USE.txt
  • dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: 3HVlmmpu

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • dll/celeryuwpver
  • dll/uwpoff.bin
  • dll/uwpoffver
  • dll/uwpversion.txt
  • scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: 3HVlmmpu

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections