Static

static

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    OpenThis.zip

  • Size

    66.3MB

  • MD5

    cecb348cf99e80c52d34b69e7d134cc0

  • SHA1

    5313e8e82ed6e512e262beeff66c190b85da7aff

  • SHA256

    9ffda7489a177dcad248ee912d54b797a8da593e6f0bd20b0dc6fcf54c277127

  • SHA512

    79d76639addf3b4489754721f14024030beb1ae206cbac5c12fecbb6ab28ae826ca1913a59dcac851e2ec772438b30e7f6b33bc6528893851a114e5bb13858a4

  • SSDEEP

    1572864:yD8ILzISgxMIkQVjbY9Bt9o1webs+baXm8w9yV/BautEBNJOXj:yYkzIeIkQVjoB/8webxVy1Ec

Score
9/10
cryptonepacker

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • OpenThis.zip
    .zip

    Password: xeno

  • Exec.zip
    .zip

    Password: xeno

  • Executor/Xeno.exe
    .exe windows:6 windows x86 arch:x86

    Password: xeno

    1aae8bf580c846f39c71c05898e57e88


    Headers

    Imports

    Sections

  • Executor/autoexec/test.lua
  • Executor/autoexec/test2.lua
  • Executor/locales/af.pak
  • Executor/locales/am.pak
  • Executor/locales/ar.pak
  • Executor/locales/bg.pak
  • Executor/locales/bin/api
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: xeno

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor/locales/bn.pak
  • Executor/locales/ca.pak
  • Executor/locales/cs.pak
  • Executor/locales/da.pak
  • Executor/locales/de.pak
  • Executor/locales/el.pak
  • Executor/locales/en-GB.pak
  • Executor/locales/en-US.pak
  • Executor/locales/es-419.pak
  • Executor/locales/es.pak
  • Executor/locales/et.pak
  • Executor/locales/fa.pak
  • Executor/locales/fi.pak
  • Executor/locales/fil.pak
  • Executor/locales/fr.pak
  • Executor/locales/gu.pak
  • Executor/locales/he.pak
  • Executor/locales/hi.pak
  • Executor/locales/hr.pak
  • Executor/locales/hu.pak
  • Executor/locales/id.pak
  • Executor/locales/it.pak
  • Executor/locales/ja.pak
  • Executor/locales/kn.pak
  • Executor/locales/ko.pak
  • Executor/locales/lt.pak
  • Executor/locales/lv.pak
  • Executor/locales/ml.pak
  • Executor/locales/mr.pak
  • Executor/locales/ms.pak
  • Executor/locales/nb.pak
  • Executor/locales/nl.pak
  • Executor/locales/pl.pak
  • Executor/locales/pt-BR.pak
  • Executor/locales/pt-PT.pak
  • Executor/locales/ro.pak
  • Executor/locales/ru.pak
  • Executor/locales/sk.pak
  • Executor/locales/sl.pak
  • Executor/locales/sr.pak
  • Executor/locales/sv.pak
  • Executor/locales/sw.pak
  • Executor/locales/ta.pak
  • Executor/locales/te.pak
  • Executor/locales/th.pak
  • Executor/locales/tr.pak
  • Executor/locales/uk.pak
  • Executor/locales/ur.pak
  • Executor/locales/vi.pak
  • Executor/locales/zh-CN.pak
  • Executor/locales/zh-TW.pak
  • Executor/scripts/Dex.lua
    .js
  • Executor/scripts/Infinite Yield.lua
    .js
  • Executor/scripts/Sine Wave.lua
  • Executor/scripts/Spinning Donut.lua
  • Executor/scripts/UNCCheckEnv.lua
    .js
  • Executor/workspace/.tests/appendfile.txt
  • Executor/workspace/.tests/getcustomasset.txt
  • Executor/workspace/.tests/isfile.txt
  • Executor/workspace/.tests/listfiles/test_1.txt
  • Executor/workspace/.tests/listfiles/test_2.txt
  • Executor/workspace/.tests/loadfile.txt
  • Executor/workspace/.tests/readfile.txt
  • Executor/workspace/.tests/writefile
  • Executor/workspace/.tests/writefile.txt
  • Executor/workspace/EzHubLL.txt
  • Executor/workspace/IY_FE.iy
  • Executor/workspace/Sky Hub/Sky Hub Settings.json
  • README.txt