General

  • Target

    Release.zip

  • Size

    19.6MB

  • MD5

    ebd33cf936c8b8b726ed30c8d7da7161

  • SHA1

    018781e13fda046407e1d85d5ff64963f24eb5c2

  • SHA256

    ae98811164cee18f574647755ec829d1973f508b7a6e378768bf4346ab70604f

  • SHA512

    fb77ce6f17d26b84ed64b7a88084bb569982b0b6eef609365b0349b62e9d5854ec1f61213f6af6ef3193f98720bc1f09041c7c31fcef46a4ea44b7c517ae447d

  • SSDEEP

    393216:pPf9HYaL7tSMlbpqj0tJCV35rWimatHzyd3V806Nqw4VGT:F+WZxIV3nm2Tyb80ciI

Score
9/10

Malware Config

Signatures

  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Release.zip
    .zip

    Password: ryos

  • Bootstrapper/Release.exe
    .exe windows:5 windows x86 arch:x86

    Password: ryos

    e585778ed551423154e685a66e0b2b39


    Headers

    Imports

    Sections

  • Bootstrapper/scripts/config.txt
    .js
  • Bootstrapper/scripts/local
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bootstrapper/scripts/scripthub
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bootstrapper/scripts/uwp
    .dll windows:6 windows x86 arch:x86

    Password: ryos

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • README.txt