Extracted

• • Target
    Cypter Server v2.0.zip
  • Size 17.1MB
  • SHA256 93ff00efa98418d5fac3064a6df9535b2f55d3236b827ab50957044532c90aa3
  • MD5 a1b7964306b99968c33ab6a7ded2bb4d
  • SHA1 1ff758e1e1bca338e96151b426e10f7e24320906
  • SHA512 deb9a8001a0d972881ceb6d9c22adb1927ae04751c54ef65df52ae0bbd28d94e0fc312ff239ec078061f5aa543678a6b442b295bad9cae63e45325570e6b7c62
  • SSDEEP 393216:kJL9QlqkYEl5YjWuSLUxJEI0DQOnJ0z0vyoSQfTqKTh9E2uC:k5ZkX5NuSgxI3nU0dSUW6h
  • TLSH
    T15E07334545C38A23C854F233DB755B692226BF3878E4EBF0EB289C1942E54E8D67C6F4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe
  • Size 417KB
  • SHA256 26572eb18720ec0498b293bf9259e2d797e929946b9df2bd7f78a84fd833f814
  • MD5 c7b5452918278f6695ef9b489eb60787
  • SHA1 d918cbe2f3f4e9d67ddead70bbf46d54c34365ce
  • SHA512 637f92921a5099bf8f00ee501f41146c81b91e8429d5d85b2c4f4fb28d9ffe757ae4c965da108536ec8242a12d9dbd0a6c49b56ad419efca3bf07a8d0f62cc4d
  • SSDEEP 3072:V5NryH88Ffyjy+Q0v341ZQbzILLt08+gb01zQn4jTrhhl92U0s:VDCH+7voZgU0ebIrbp
  • TLSH
    T10C94C1952EC39671E19816F432AEEBE406677D06AC2BC67D2DF477CA37F13A085C0990
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral2
• • Target
    Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.config
  • Size 1KB
  • SHA256 2726c7c722b8c87e8a9a15d7aad4d0fc80ac45de9f0e23a0ca4184d8fdae2f3b
  • MD5 5083d2a1e6608c0012039fb495dcc226
  • SHA1 8f362a8c816a0c3fb36bdb6fd1d7f6dcf49532f5
  • SHA512 e8be604e1f9f7ede2874ca7e963cda5487e964d61529b29923820d2436a3f8155a79839dbc44d6798ffce527999cbe8e677fc5e55ca881add12bd6aedc78cb73
  • TLSH
    T12531F356F5D00CF649A3A763BE204A41DF364E5B724D410CF8ADA68B5F3286D93033D2
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3
• • Target
    Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
  • Size 666KB
  • SHA256 fea09c08245115bcac9299658926a3065fb1fb90899ba143d32c9983150205d5
  • MD5 a3d7da276c97d646a582029dc93587a2
  • SHA1 f42e36baea56c299ec513f86c0d259f7d81e9f88
  • SHA512 c9ae34c34d729a501fa11f125532d23b02f6b169c68d98bcafba3ed7f0dab98aa8b2bec182c263de2d9de0c82a50f3b45ad3c4f8bfe987755a5bb5424aaa3304
  • SSDEEP 12288:W3BNvkWEvoumAVu5Y4IiNLnp0XZuNGSIPTJAQOc0R6aTEHaQLokCiZvf:W3rvUvoumku530k9IPT+MUPAlZX
  • TLSH
    T1A4E42369FBFABF800878DC01D819C1405BAE52281F1BBACE545FAD618C56D1CB3D7AC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4
• • Target
    Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe
  • Size 60KB
  • SHA256 b082a9185b05574a00e75a6b0ca6c63a3b32567201f21a534db5e7d9c96d6eee
  • MD5 0f4e37060b40ec08236f2ff7fffac768
  • SHA1 9b83128951d67aa34b23f34ecc7e910d7856f1d7
  • SHA512 5e931246875d37fa5a85c4bdd4269b6a8f5a94cf4c583da90023f7033762b40d01aff2f00a4b93d4edaee55cfe947c521bd0de5185ea430813d5f3a2bbc37bdf
  • SSDEEP 1536:e84x0kUjROP2XHv3wZ5FzGsgbCkbfTR3cwl+puOehMi+:P4xXPoPwnFzGrukbfTG7uOeG
  • TLSH
    T18A537C08BBE64235F4FEAFB61AF57112C678B2175923961F28C441861B23E8DCD41BF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral5
• • Target
    Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
  • Size 288KB
  • SHA256 d1fae8efd7307828e323e9fa7e670b8faf31f80be730c8d4731f32a107265cdc
  • MD5 26c343682e8bf3a36dcdc324b5fff2c5
  • SHA1 9a51630f50b6e866cfc61410aeb9ada2c09819cc
  • SHA512 af46aae61869c8c8a82337209d31563146f1d31cfda98946707b1813e4d6db7fe19930f3c5a00c544363900c560205a61bbc09513de3a9adb3719dbf696d3ade
  • SSDEEP 6144:1i7GRM+R19BUBS+H9Dr+kLZ7Fvgd7e+jY4HZdj8f:1aGCuzrYt+6HvMj/j
  • TLSH
    T1F5543F9170585883E81731F1DC9FDA30225EABDF5239C70E3653FB1A5A9336620A7E4B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral6