General

  • Target

    R3leases-x64.zip

  • Size

    12.0MB

  • MD5

    d1a53b1efed9e7d9a95e99e67fa5e98e

  • SHA1

    0772395d2f19bf1b78ac664e2decc2c1804b4157

  • SHA256

    c1fc5546843864a8d825b8d1bc19682e40d9d2755486397f4336d3d56a8e2f2f

  • SHA512

    8e2840d42cbbb751614f0a88cdea4845ae595007860eab2051edc46783d6d7d575251173a758e34e5fed672ce03d21840e7e8955930020676cded5f7cad70efc

  • SSDEEP

    196608:WO5vl+5g1u9ytFg7Xp3c+dELm4HqDRg5bF+eGpvJPFFRNSCGNEnsrBaF:W8iytFg7X6+Ym+qD25bFivF7SCQEnuMF

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • R3leases-x64.zip
    .zip

    Password: ryos

  • Bootstrapper.exe
    .exe windows:5 windows x86 arch:x86

    Password: ryos

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/Factors
  • $TEMP/Kijiji
  • $TEMP/Paradise
  • $TEMP/Talent
  • GraceDedicated/Attempt
  • GraceDedicated/Injuries
    .cab

    Password: ryos

  • Alan
  • Cio
  • Client
  • Contribute
  • Dept
  • Dialog
  • Eagle
  • Lotus
  • Relying
  • Resolved
  • Ta
  • GraceDedicated/Metres
  • GraceDedicated/Nice
  • GraceDedicated/Outlet
  • GraceDedicated/Row
  • README.txt
  • scripts/config.txt
    .js
  • scripts/local
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scripts/uwp
    .dll windows:6 windows x86 arch:x86

    Password: ryos

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections