cru-1[.]5[.]3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cru-1.5.3.zip
Size 532KB
Sample260423-bbvs2sfs4s
SHA256 9201e9770b4d3d2512ee7f7f979127e4a73e8f6bf77865a8570d662ba72f88c8
MD5 590b31dad99cea2a38d7fd0d6acce495
SHA1 46d2a947189743f6c19bc12782188dee5597a832
SHA512 9b15e790fdf5ae6fbc2345b3a9f75a0125428cfd51039261c5550ceb4348956661e6bc8693b9af28dc367ffe1ce606e67b41c7336f5e1e14b24617a247c75d34
SSDEEP 12288:5Rrlk0uzqJK2SEcpcJjiGl/ZVJ5KI+9BXpCvwy8Z:5XQ22GJjiGl/ZVJ8IO+vT8Z
TLSH
T188C42329C21F6FDA7E5A34249DBDDAF17502D2F0640A7AC36D44BEC743A6221E84C4E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CRU.exe
unpack001/reset-all.exe
unpack001/restart.exe
unpack001/restart64.exe

File Explorer

cru-1.5.3.zip

.zip 532KB
CRU.exe

.exe 1.2MB
Info.txt

635B
reset-all.exe

.exe 51KB
restart.exe

.exe 63KB
restart64.exe

.exe 73KB

cru-1.5.3.zip

SHA256 9201e9770b4d3d2512ee7f7f979127e4a73e8f6bf77865a8570d662ba72f88c8
MD5 590b31dad99cea2a38d7fd0d6acce495
SHA1 46d2a947189743f6c19bc12782188dee5597a832
SHA512 9b15e790fdf5ae6fbc2345b3a9f75a0125428cfd51039261c5550ceb4348956661e6bc8693b9af28dc367ffe1ce606e67b41c7336f5e1e14b24617a247c75d34
SSDEEP 12288:5Rrlk0uzqJK2SEcpcJjiGl/ZVJ5KI+9BXpCvwy8Z:5XQ22GJjiGl/ZVJ8IO+vT8Z
TLSH
T188C42329C21F6FDA7E5A34249DBDDAF17502D2F0640A7AC36D44BEC743A6221E84C4E7
MD5 SHA1 SHA512 SSDEEP TLSH

CRU.exe

IMPHASH cafc89e1b0a9b2c5b10389d6d19936ce
SHA256 6bd53f11c51bab8fd438478bfa8a757bf8c4950c0fc23ccee385083030f126ef
MD5 952d4852dc00cccf96379ae54d49586f
SHA1 2207a75774ff4a764ac9cc09a1b04d1d63ffbb3d
SHA512 8327756a0c4dd26ce1574ffd0521ebfdc23226791690a4fe6948b67ce4ea9734c3a1ffbced0217ba8b2d293b6d96b8ab78044b0abdcd5ec5c24269970e92f327
SSDEEP 24576:xHSmCPmntsnkqw2O5yTLsm1wL5rEcuJKWzBIvH5:xymCPmnAkcOPEevH
TLSH
T1005539A276D0C032C0230574DE7BCAF559257E24DB30A6877BE03E5F7EB5B807926296
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegFlushKey RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CompareStringA CreateEventA CreateFileA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection EnumCalendarInfoA ExitProcess FindClose FindFirstFileA FindResourceA FormatMessageA FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileType GetFullPathNameA GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetThreadLocale GetTickCount GetUserDefaultLCID GetVersion GetVersionExA GlobalAddAtomA GlobalDeleteAtom GlobalFindAtomA HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedExchange InterlockedIncrement IsValidLocale LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadResource LockResource MulDiv MultiByteToWideChar RaiseException ReadFile ResetEvent RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetThreadLocale SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcpyA lstrcpynA lstrlenA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIconSize ImageList_GetImageCount ImageList_Read ImageList_Remove ImageList_Replace ImageList_SetBkColor ImageList_SetIconSize ImageList_Write _TrackMouseEvent ImageList_Create

comdlg32

GetOpenFileNameA GetSaveFileNameA

gdi32

BitBlt CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateDIBitmap CreateFontIndirectA CreateHalftonePalette CreatePalette CreatePenIndirect CreateSolidBrush DeleteDC DeleteObject Ellipse ExcludeClipRect ExtTextOutA GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetObjectA GetPaletteEntries GetPixel GetRgnBox GetStockObject GetSystemPaletteEntries GetTextExtentPoint32A GetTextMetricsA GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt RealizePalette RectVisible Rectangle RestoreDC RoundRect SaveDC SelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetPixel SetROP2 SetStretchBltMode SetTextColor SetViewportOrgEx SetWindowOrgEx StretchBlt UnrealizeObject

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint CallNextHookEx CallWindowProcA CharLowerA CharNextA CharToOemA CheckDlgButton CheckMenuItem ClientToScreen CreateIcon CreateMenu CreatePopupMenu CreateWindowExA DefFrameProcA DefMDIChildProcA DefWindowProcA DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextA EnableMenuItem EnableScrollBar EnableWindow EndPaint EnumChildWindows EnumThreadWindows EnumWindows EqualRect FillRect FindWindowA FrameRect GetActiveWindow GetCapture GetClassInfoA GetClassLongA GetClientRect GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextA GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameA GetKeyboardState GetKeyboardType GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuState GetMenuStringA GetMessagePos GetParent GetPropA GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetTopWindow GetWindow GetWindowDC GetWindowLongA GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextA GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemA IntersectRect InvalidateRect IsChild IsDialogMessageA IsDialogMessageW IsDlgButtonChecked IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible IsZoomed KillTimer LoadBitmapA LoadCursorA LoadIconA LoadKeyboardLayoutA LoadStringA MapVirtualKeyA MapWindowPoints MessageBoxA OemToCharA OffsetRect PeekMessageA PeekMessageW PostMessageA PostQuitMessage PtInRect RedrawWindow RegisterClassA RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu RemovePropA ScreenToClient ScrollWindow SendMessageA SendMessageW SetActiveWindow SetCapture SetClassLongA SetCursor SetFocus SetForegroundWindow SetMenu SetMenuItemInfoA SetParent SetPropA SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongA SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextA SetWindowsHookExA ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoA TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow WaitMessage WindowFromPoint wsprintfA GetSystemMetrics

oleaut32

SafeArrayCreate SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantInit

Name

.text

Size

785KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

164KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

reset-all.exe

IMPHASH 32f33abb2edf5d9be4310f0050d459d0
SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
MD5 3d47586c62bf61dac639d8cc1bf43ee7
SHA1 36f605e1fb7cae972c6723ded6a5f126f36a8d01
SHA512 638a75c0159de8553e8071a68b5a4355bfc002489d9ed62bfbb1019d287073a555133bd4a55abd68c51b3e2a1616f586a26998ce32ade322cd72ffeab5ffe105
SSDEEP 768:Jd0XBRNU+hV81e14G8xGvMhBmqVHhc6ZrLy01fA5Egt2rHNZAEDFn27DQNE5B:b0XbeQ8xG0Kqjc6lLFfSortZBMDu8
TLSH
T1C1335D12B7D1C033E4A229344975C2629A7F38325A78D68F379416AD5FB07D3EE38366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

MessageBoxW

advapi32

RegSetValueExW RegQueryValueExW RegDeleteValueW RegDeleteTreeW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey

kernel32

TlsFree FlushFileBuffers GetLastError HeapFree HeapAlloc GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate GetProcAddress GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW EncodePointer GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue SetLastError GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind HeapSize IsProcessorFeaturePresent HeapReAlloc SetStdHandle WriteConsoleW CreateFileW CloseHandle

restart.exe

IMPHASH cf4f510acda53bad738cb1d4e01b1c70
SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
MD5 8242ce426ad462eff02edae1487a6949
SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
TLSH
T160535B11B691C03AF0A225304DB5D3A18E3EBC32577994CF7794127D4EB27E2EA78366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14313

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapSize IsProcessorFeaturePresent HeapReAlloc RtlUnwind CompareStringW GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryW SetStdHandle GetStringTypeW WideCharToMultiByte WriteConsoleW CreateFileW IsWow64Process GetModuleFileNameW Sleep CreateProcessW CloseHandle CreateToolhelp32Snapshot Process32NextW Process32FirstW GetStartupInfoW TerminateProcess OpenProcess GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetLastError HeapFree HeapAlloc SetEnvironmentVariableW GetCurrentDirectoryW SetCurrentDirectoryW GetCommandLineW HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress HeapCreate ExitProcess WriteFile GetStdHandle MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LCMapStringW FlushFileBuffers

user32

SetWindowPlacement GetWindowRect EnumWindows GetWindowPlacement SetWindowPos ShowWindow IsWindowVisible SetForegroundWindow DialogBoxParamW OpenInputDesktop FindWindowW GetClientRect CloseDesktop EndDialog FindWindowExW MessageBoxW UnregisterHotKey RegisterHotKey GetWindowThreadProcessId GetShellWindow PostMessageW

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegEnumValueW RegRenameKey RegDeleteTreeW RegDeleteValueW RegQueryValueExW RegCreateKeyExW AdjustTokenPrivileges DuplicateTokenEx LookupPrivilegeValueW CreateProcessWithTokenW OpenProcessToken RegSetValueExW

setupapi

SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiCallClassInstaller

restart64.exe

IMPHASH 2a69fe822ced9bf301916c1307e497a9
SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
MD5 297aa19bade534a791d053ca190b74ad
SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
TLSH
T160735C4633E510F9E467A238C9F28915E2B3F816537A834F476047561F63B91AE3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapSize HeapReAlloc CompareStringW GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryW SetStdHandle GetStringTypeW WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount WriteConsoleW CreateFileW IsWow64Process GetModuleFileNameW Sleep CreateProcessW CloseHandle CreateToolhelp32Snapshot Process32NextW Process32FirstW GetStartupInfoW TerminateProcess OpenProcess GetCurrentProcess QueryPerformanceCounter GetFileType SetHandleCount LCMapStringW EnterCriticalSection GetLastError HeapFree HeapAlloc SetEnvironmentVariableW GetCurrentDirectoryW SetCurrentDirectoryW GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc DecodePointer HeapSetInformation GetVersion HeapCreate GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW RtlUnwindEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection FlushFileBuffers

user32

advapi32

setupapi

SetupDiSetClassInstallParamsW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiCallClassInstaller

cru-1.5.3.zip

CRU.exe

setupapi

advapi32

kernel32

version

comctl32

comdlg32

gdi32

user32

oleaut32

generic

Info.txt

reset-all.exe

user32

advapi32

kernel32

generic

restart.exe

kernel32

user32

advapi32

setupapi

generic

restart64.exe

kernel32

user32

advapi32

setupapi

generic