General

  • Target

    RELEASE-x64.zip

  • Size

    19.6MB

  • MD5

    55f0d5b83bb9e52c7027d7f58ea1b317

  • SHA1

    c145528d6209902d6f44272feac808c73ddc2eea

  • SHA256

    d34af86f5efcdea63260b1cd4dccb5d7149bdff4ce7cb23acadfaacb5785b861

  • SHA512

    37d0f6d7a250789f79a5df58fc94861a24e593669921223297b41f23e3ab194b10615857889c362c38018306b5a0ed1ef6e614bc9090616eefc1eed59c4af27b

  • SSDEEP

    393216:+p+vNSw8Un0A3AQ5dC56iaMKAw4WLzWJCuqbt12PA5QQQGR0:r1qUnH3AQ5LiaDFXLiJwMA5e

Score
9/10

Malware Config

Signatures

  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • RELEASE-x64.zip
    .zip

    Password: ryos

  • README.txt
  • Release/Bootstrap.exe
    .exe windows:5 windows x86 arch:x86

    Password: ryos

    f71fb35a44e4f13ae28861188ff76c72


    Headers

    Imports

    Sections

  • Release/scripts/config.txt
    .js
  • Release/scripts/local
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Release/scripts/scripthub
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Release/scripts/uwp
    .dll windows:6 windows x86 arch:x86

    Password: ryos

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections