General

  • Target

    CrystalLine Executer.zip

  • Size

    3.1MB

  • MD5

    999924daac036b4781dc2eb9a9e63289

  • SHA1

    2eee47193ba23a01907e0d3a0e020cc82ac0021c

  • SHA256

    ea05fe5526da3b785ff84314114807174f0cd52a5e80a942b2219344397a8b3c

  • SHA512

    5d3b21d91b018a9b3db523c1963240e9e3051471d30f2670b87437eca58c1b19ebb24fb7bf93d75ba765d80d5242433fc1cbf8f32bb47f40e6513c8f98a9a871

  • SSDEEP

    98304:UYar6kRptkHyNRPxjrMcC9RxThW0Pme+lg1H:UYKbtkSNRPJ5C9bLPmeg0H

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • CrystalLine Executer.zip
    .zip
  • CrystalLine Executer/Crystaline Executer.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • CrystalLine Executer/Crystaline Executer.exe.config
  • CrystalLine Executer/Crystaline Executer.pdb
  • CrystalLine Executer/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • CrystalLine Executer/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • CrystalLine Executer/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • CrystalLine Executer/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • CrystalLine Executer/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • CrystalLine Executer/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • CrystalLine Executer/thing tom.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CrystalLine Executer/thingbob.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CrystalLine Executer/workspace/.tests/appendfile.txt
  • CrystalLine Executer/workspace/.tests/getcustomasset.txt
  • CrystalLine Executer/workspace/.tests/isfile.txt
  • CrystalLine Executer/workspace/.tests/listfiles/test_1.txt
  • CrystalLine Executer/workspace/.tests/listfiles/test_2.txt
  • CrystalLine Executer/workspace/.tests/loadfile.txt
  • CrystalLine Executer/workspace/.tests/readfile.txt
  • CrystalLine Executer/workspace/.tests/writefile
  • CrystalLine Executer/workspace/.tests/writefile.txt
  • CrystalLine Executer/workspace/286090429.txt
  • CrystalLine Executer/workspace/FluentScriptHub/options.json
  • CrystalLine Executer/workspace/IY_FE.iy
  • CrystalLine Executer/workspace/KavoConfig.JSON
  • CrystalLine Executer/workspace/silent_rivals/6035872082.txt
  • CrystalLine Executer/workspace/vape/CustomModules/6872265039.lua
    .js
  • CrystalLine Executer/workspace/vape/CustomModules/6872274481.lua
    .js
  • CrystalLine Executer/workspace/vape/CustomModules/cachechecked.txt
  • CrystalLine Executer/workspace/vape/GuiLibrary.lua
    .js
  • CrystalLine Executer/workspace/vape/Libraries/entityHandler.lua
    .js
  • CrystalLine Executer/workspace/vape/Libraries/sha.lua
    .js
  • CrystalLine Executer/workspace/vape/MainScript.lua
    .js
  • CrystalLine Executer/workspace/vape/Profiles/whitelist.json
  • CrystalLine Executer/workspace/vape/Universal.lua
    .js
  • CrystalLine Executer/workspace/vape/assets/AddItem.png
    .png
  • CrystalLine Executer/workspace/vape/assets/BackIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/BindBackground.png
    .png
  • CrystalLine Executer/workspace/vape/assets/BlatantIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/CircleListBlacklist.png
    .png
  • CrystalLine Executer/workspace/vape/assets/ColorSlider1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/CombatIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/DiscordIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/DownArrow.png
    .png
  • CrystalLine Executer/workspace/vape/assets/ExitIcon1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/FriendsIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/HoverArrow.png
    .png
  • CrystalLine Executer/workspace/vape/assets/HoverArrow3.png
    .png
  • CrystalLine Executer/workspace/vape/assets/KeybindIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/LegitModeIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/MoreButton1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/MoreButton2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/MoreButton3.png
    .png
  • CrystalLine Executer/workspace/vape/assets/OnlineProfilesButton.png
    .png
  • CrystalLine Executer/workspace/vape/assets/PencilIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/PinButton.png
    .png
  • CrystalLine Executer/workspace/vape/assets/ProfilesIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/RadarIcon1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/RadarIcon2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/RainbowIcon1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/RenderIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/RightArrow.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SearchBarIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SettingsWheel1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SettingsWheel2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SliderArrow1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SliderArrowSeperator.png
    .png
  • CrystalLine Executer/workspace/vape/assets/SliderButton1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TargetInfoIcon1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TargetInfoIcon2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextBoxBKG.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextBoxBKG2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextGUIIcon1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextGUIIcon2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextGUIIcon3.png
    .png
  • CrystalLine Executer/workspace/vape/assets/TextGUIIcon4.png
    .png
  • CrystalLine Executer/workspace/vape/assets/ToggleArrow.png
    .png
  • CrystalLine Executer/workspace/vape/assets/UpArrow.png
    .png
  • CrystalLine Executer/workspace/vape/assets/UtilityIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assets/VapeCape.png
    .png
  • CrystalLine Executer/workspace/vape/assets/VapeLogo1.png
    .png
  • CrystalLine Executer/workspace/vape/assets/VapeLogo2.png
    .png
  • CrystalLine Executer/workspace/vape/assets/VapeLogo3.png
    .png
  • CrystalLine Executer/workspace/vape/assets/VapeLogo4.png
    .png
  • CrystalLine Executer/workspace/vape/assets/WindowBlur.png
    .png
  • CrystalLine Executer/workspace/vape/assets/WorldIcon.png
    .png
  • CrystalLine Executer/workspace/vape/assetsversion.txt
  • CrystalLine Executer/workspace/vape/commithash.txt