Analysis
- user interaction
yes - max time kernel
898s - max time network
442s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 03:07
Behavioral task
behavioral1
Sample
Cypter Server v2.0.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.xml
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
Resource
win10v2004-20260513-en
General
- Target Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
- Size 666KB
- Sample260804-dmstyafk2s
- SHA256 fea09c08245115bcac9299658926a3065fb1fb90899ba143d32c9983150205d5
- MD5 a3d7da276c97d646a582029dc93587a2
- SHA1 f42e36baea56c299ec513f86c0d259f7d81e9f88
- SHA512 c9ae34c34d729a501fa11f125532d23b02f6b169c68d98bcafba3ed7f0dab98aa8b2bec182c263de2d9de0c82a50f3b45ad3c4f8bfe987755a5bb5424aaa3304
- SSDEEP 12288:W3BNvkWEvoumAVu5Y4IiNLnp0XZuNGSIPTJAQOc0R6aTEHaQLokCiZvf:W3rvUvoumku530k9IPT+MUPAlZX
- TLSH T1A4E42369FBFABF800878DC01D819C1405BAE52281F1BBACE545FAD618C56D1CB3D7AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 mspaint.exe 1964 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1964 mspaint.exe 1964 mspaint.exe 1964 mspaint.exe 1964 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Cypter Server v2.0\CrackedBySamuriCypter Server v2.0.1\Ktama Crypter Server v2.0.1.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4364