General

  • Target

    R3LEAS3-x64.zip

  • Size

    12.0MB

  • MD5

    747736943b1252e6908e287b860b56ea

  • SHA1

    2af62b65c53a7d65506dba29843abf80b07d1759

  • SHA256

    d9e50329018579863b468285925808e052c3c5ffd2e06decb50e086f2700418b

  • SHA512

    77d475176bf55cd2cb2c046dddc65092de694ce7425b91c855e7239e08f6189fb6c994002de5c8eadecbb1d79762e3071786ba1fe61b219267f4ff238bedef37

  • SSDEEP

    196608:s4ca4YKr9FKVbbskNKCT/5UxTTUl3T0rWqcocbPABvg8cStx60d53sajQypG:cXYc9FKVbbsk5T/5kDcocbPABvg87BjG

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • R3LEAS3-x64.zip
    .zip

    Password: ryos

  • Bootstrapper.exe
    .exe windows:5 windows x86 arch:x86

    Password: ryos

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/Factors
  • $TEMP/Kijiji
  • $TEMP/Paradise
  • $TEMP/Talent
  • GraceDedicated/Attempt
  • GraceDedicated/Injuries
    .cab

    Password: ryos

  • Alan
  • Cio
  • Client
  • Contribute
  • Dept
  • Dialog
  • Eagle
  • Lotus
  • Relying
  • Resolved
  • Ta
  • GraceDedicated/Metres
  • GraceDedicated/Nice
  • GraceDedicated/Outlet
  • GraceDedicated/Row
  • README.txt
  • scripts/config.txt
    .js
  • scripts/local
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scripts/uwp
    .dll windows:6 windows x86 arch:x86

    Password: ryos

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections