General

  • Target

    08.06.2024 Updated Ver 3.2 PC [no key].zip

  • Size

    9.6MB

  • MD5

    c6d1f63c7f1b52ebea21777fe14bd76f

  • SHA1

    d24be8079674e99130b3f65022f8f501dd9a1cbb

  • SHA256

    529804cf8e209aebaa8561fdca5ddd0d9d834b6c490266293380108298eac7e5

  • SHA512

    09662630c251c342fca791cfdeeb8c00d114fe70ee5d3ea724fd814f490cda4ff17e62852c806ebeb7f32f06c0edfe7383e74c6b1e3ce0d36c2f733c1173ea5a

  • SSDEEP

    196608:94dxwBHWwKSMT5srIxB/7Mwvv4oawO7Qgs3fX/Wa2acdWLSTvq3:GYBqCr2vvv4oaP7Qgs3fxBuWLSG3

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 08.06.2024 Updated Ver 3.2 PC [no key].zip
    .zip

    Password: R6RWdVei

  • OPEN ME.rar
    .rar

    Password: R6RWdVei

  • SolaraX.exe
    .exe windows:5 windows x86 arch:x86

    Password: R6RWdVei

    66fcdd6338ffed276966867e7cf86116


    Code Sign

    Headers

    Imports

    Sections

  • dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: R6RWdVei

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • dll/VMProtectSDK32.lib
  • dll/autoexec/HOW_TO_USE.txt
  • dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: R6RWdVei

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • dll/celeryuwpver
  • dll/uwpoff.bin
  • dll/uwpoffver
  • dll/uwpversion.txt
  • scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: R6RWdVei

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • README.txt