061d59735ea2397cbb2566ddb711d1ea73a79e5f171a6ed5f328c0d8b078c426[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

061d59735ea2397cbb2566ddb711d1ea73a79e5f171a6ed5f328c0d8b078c426.zip
Size

245KB
MD5

aab76cd4195fef809763c72944e6c2ff
SHA1

b0e9c28d4f1c4a59c1780c7991426c5a7643b959
SHA256

061d59735ea2397cbb2566ddb711d1ea73a79e5f171a6ed5f328c0d8b078c426
SHA512

4fb8c02ee6237da50ec84ce10e0b98184458dc81495ff4de265c9ebf9a36c3efec1fde032d8d7d50eba2c78cda7557b7fad83de920a969d3b8ecd0726e8538f9
SSDEEP

6144:enyEbzn4VwcCC8U5aVFXGfTNQtllCRtradvUeCwMx:eFbz44CzamfT2UrWvMwMx

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
static1/unpack001/b69f17a7126bf24174e8d6cd594c5ebb28485db8e3943b0cebc5bf1225d6c6ae.dll	cryptone

Files

061d59735ea2397cbb2566ddb711d1ea73a79e5f171a6ed5f328c0d8b078c426.zip
.zip

Password: infected
b69f17a7126bf24174e8d6cd594c5ebb28485db8e3943b0cebc5bf1225d6c6ae.dll
.dll windows:4 windows x86 arch:x86

a326e84e9e4432f34b03d70a0c7d4ddf

Code Sign

b8:b5:8b:6c:fe:39:5e:33:8f:34:76:d1:21:e7:81:39
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/11/2020, 00:00

Not After

11/11/2021, 23:59

Subject

CN=Školab s.r.o.,O=Školab s.r.o.,POSTALCODE=500 03,STREET=Víta Nejedlého 1161/1b,L=Hradec Králové,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:b3:33:49:af:cb:b9:58:40:6a:0b:55:82:01:7b:ec:94:fc:6b:9a
Signer

Actual PE Digest

90:b3:33:49:af:cb:b9:58:40:6a:0b:55:82:01:7b:ec:94:fc:6b:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFree
FormatMessageA
GetLastError
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCommandLineA
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetExitCodeThread
FindFirstFileA
FindNextFileA
FindClose
HeapSetInformation
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
DecodePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
MultiByteToWideChar
GetFileAttributesA
ExitThread
GetCurrentThreadId
CreateThread
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapCreate
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
LoadLibraryW
RtlUnwind
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
SetStdHandle
LCMapStringW
GetStringTypeW
SetFilePointer
CompareStringW
HeapSize
ReadFile
GetDriveTypeW
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
WriteConsoleW
ResetEvent
SetThreadContext
SetComputerNameExA
CreateMutexA
WritePrivateProfileStructA
WriteConsoleOutputW
GetComputerNameA
GlobalMemoryStatusEx
TerminateThread
GetConsoleOutputCP
AddAtomA
CreateFileMappingA
ResumeThread
GetFileSize
CallNamedPipeA
WaitNamedPipeA
GetFileAttributesExW
GetCurrencyFormatA
GetCommandLineW
IsBadStringPtrW
GetPrivateProfileStructW
FindNextVolumeMountPointW
SetConsoleWindowInfo
lstrlen
RtlFillMemory
OpenJobObjectW
CompareStringA
FindFirstVolumeA
WaitForSingleObjectEx
CreateSemaphoreA
GetCommState
GetBinaryTypeA
GetNamedPipeInfo
FindNextFileW
DnsHostnameToComputerNameW
GlobalWire
FreeEnvironmentStringsA
SetSystemTime
CreateRemoteThread
VirtualFree
VirtualQuery
VirtualAlloc
GetVersion
VirtualProtect
InitializeCriticalSection
FatalAppExitW
FreeLibrary
SetDllDirectoryW
LoadLibraryExW
VirtualAllocEx
SetErrorMode

user32

MessageBoxA
DeleteMenu
UnregisterClassW
IsWindowEnabled
DragObject
DdeAddData
RegisterClassW
GetKeyboardLayoutList
EnumDesktopsA
GetWindowTextA
DdeCreateDataHandle
AnimateWindow
IMPGetIMEA
GetMenuContextHelpId
DdeUnaccessData
DefMDIChildProcW
GetClassNameW
SetCaretPos
MenuItemFromPoint
CreateIcon
DrawFocusRect
GetOpenClipboardWindow
GetLastActivePopup
GetKBCodePage
IsGUIThread
IsClipboardFormatAvailable
AnyPopup
GetForegroundWindow
VkKeyScanA
CharNextW
GetClipboardOwner
CharLowerW
GetMenu
GetWindowTextLengthW
ReleaseCapture
CountClipboardFormats
GetCursor
LoadCursorFromFileA
CharUpperA
InSendMessage
IsCharLowerW
GetMessagePos
DestroyMenu
CharLowerA
GetDlgCtrlID
IsCharAlphaW
GetSystemMetrics
IsMenu
DestroyWindow
GetSysColor
GetInputState
IsCharLowerA
GetFocus
GetClipboardSequenceNumber
CloseClipboard
GetListBoxInfo
GetWindowTextLengthA
GetDC
IsWindow
LoadIconA

gdi32

EnumMetaFile
CombineRgn
SelectClipPath
CreateEnhMetaFileA
AddFontResourceA
EnumFontFamiliesA
CreateFontIndirectExW
GetCharWidthInfo
GetCharABCWidthsFloatW
CreateBrushIndirect
GetTextCharsetInfo
StrokePath
GdiDeleteSpoolFileHandle
EngCreateClip
GetFontAssocStatus
GdiEntry9
ScaleWindowExtEx
GetKerningPairs
CreateICW
GetMiterLimit
ArcTo
EngGetCurrentCodePage
EnumICMProfilesA
EngFillPath
TextOutW
FloodFill
GetCharWidth32W
EngDeleteClip
GetWinMetaFileBits
cGetTTFFromFOT
GetRgnBox
GetTextExtentExPointWPri
GdiFixUpHandle
PathToRegion
SaveDC
GetKerningPairsW
GetDIBits
GetTextExtentPoint32W
GetStockObject
EngUnicodeToMultiByteN
GdiStartPageEMF
DeleteColorSpace
ResizePalette
ExtSelectClipRgn
SetArcDirection
GetSystemPaletteUse
RealizePalette
SetMetaRgn
DeleteEnhMetaFile
CloseFigure
GetColorSpace
CreatePatternBrush
GetTextCharset
UpdateColors
EndPath
DeleteObject
CancelDC
BeginPath
GetTextAlign
WidenPath
GetBkColor
GetEnhMetaFileA
GetPixelFormat

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegOpenKeyA

shell32

ExtractIconExW
SHGetSpecialFolderPathA
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHLoadInProc
SHPathPrepareForWriteA
SHGetSpecialFolderLocation
FindExecutableW
WOWShellExecute
SHIsFileAvailableOffline
SHBindToParent
SHBrowseForFolderA

shlwapi

StrCmpNA

comctl32

InitCommonControlsEx

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

a326e84e9e4432f34b03d70a0c7d4ddf

Code Sign

b8:b5:8b:6c:fe:39:5e:33:8f:34:76:d1:21:e7:81:39Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:b3:33:49:af:cb:b9:58:40:6a:0b:55:82:01:7b:ec:94:fc:6b:9aSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 2KB - Virtual size: 1KB

b8:b5:8b:6c:fe:39:5e:33:8f:34:76:d1:21:e7:81:39
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:b3:33:49:af:cb:b9:58:40:6a:0b:55:82:01:7b:ec:94:fc:6b:9a
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 2KB - Virtual size: 1KB