Static

static

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Executor.zip

  • Size

    57.6MB

  • MD5

    d407af5c1a715251b488c1d011dcef58

  • SHA1

    ebfd32ed7b33861efb9e573262b92c845b6032c8

  • SHA256

    97714af163deececcd8071d77e23f5f8549641e4b050addfe7ae482ac80d2813

  • SHA512

    e46778595f09014d78f66f090d9ee2d2ebe6b07d8774b30dbcdd5f83b6bf2531516d676b0b8bbae2641e71c1f867ebfb5a56a0cc12d38b2b9a82aaea488dfdd0

  • SSDEEP

    1572864:h1/v55AzkXhz/JWwqTjrM+0AH3Js+RFpGDcuevz0pU9gD:hJv575BWwMrX/fmVa0pU9gD

Score
9/10
cryptonepacker

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Executor.zip
    .zip

    Password: onyx

  • Executor/BootstrapperApp.exe
    .exe windows:6 windows x86 arch:x86

    Password: onyx

    76c28592e04b2b2bb1f52b3aac6a5c55


    Headers

    Imports

    Sections

  • Executor/autoexec/test.lua
  • Executor/autoexec/test2.lua
  • Executor/bin/api
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: onyx

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor/locales/af.pak
  • Executor/locales/am.pak
  • Executor/locales/ar.pak
  • Executor/locales/bg.pak
  • Executor/locales/bn.pak
  • Executor/locales/ca.pak
  • Executor/locales/cs.pak
  • Executor/locales/da.pak
  • Executor/locales/de.pak
  • Executor/locales/el.pak
  • Executor/locales/en-GB.pak
  • Executor/locales/en-US.pak
  • Executor/locales/es-419.pak
  • Executor/locales/es.pak
  • Executor/locales/et.pak
  • Executor/locales/fa.pak
  • Executor/locales/fi.pak
  • Executor/locales/fil.pak
  • Executor/locales/fr.pak
  • Executor/locales/gu.pak
  • Executor/locales/he.pak
  • Executor/locales/hi.pak
  • Executor/locales/hr.pak
  • Executor/locales/hu.pak
  • Executor/locales/id.pak
  • Executor/locales/it.pak
  • Executor/locales/ja.pak
  • Executor/locales/kn.pak
  • Executor/locales/ko.pak
  • Executor/locales/lt.pak
  • Executor/locales/lv.pak
  • Executor/locales/ml.pak
  • Executor/locales/mr.pak
  • Executor/locales/ms.pak
  • Executor/locales/nb.pak
  • Executor/locales/nl.pak
  • Executor/locales/pl.pak
  • Executor/locales/pt-BR.pak
  • Executor/locales/pt-PT.pak
  • Executor/locales/ro.pak
  • Executor/locales/ru.pak
  • Executor/locales/sk.pak
  • Executor/locales/sl.pak
  • Executor/locales/sr.pak
  • Executor/locales/sv.pak
  • Executor/locales/sw.pak
  • Executor/locales/ta.pak
  • Executor/locales/te.pak
  • Executor/locales/th.pak
  • Executor/locales/tr.pak
  • Executor/locales/uk.pak
  • Executor/locales/ur.pak
  • Executor/locales/vi.pak
  • Executor/locales/zh-CN.pak
  • Executor/locales/zh-TW.pak
  • Executor/workspace/.tests/appendfile.txt
  • Executor/workspace/.tests/getcustomasset.txt
  • Executor/workspace/.tests/isfile.txt
  • Executor/workspace/.tests/listfiles/test_1.txt
  • Executor/workspace/.tests/listfiles/test_2.txt
  • Executor/workspace/.tests/loadfile.txt
  • Executor/workspace/.tests/readfile.txt
  • Executor/workspace/.tests/writefile
  • Executor/workspace/.tests/writefile.txt
  • Executor/workspace/EzHubLL.txt
  • Executor/workspace/IY_FE.iy
  • Executor/workspace/Sky Hub/Sky Hub Settings.json