Cypter Server v2.0.zip
- SHA256 93ff00efa98418d5fac3064a6df9535b2f55d3236b827ab50957044532c90aa3
Behavioral task
behavioral1
Sample
Cypter Server v2.0.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral3
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral4
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral6
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target Cypter Server v2.0.zip
- Size 17.1MB
- Sample260804-dmstyafk2s
- SHA256 93ff00efa98418d5fac3064a6df9535b2f55d3236b827ab50957044532c90aa3
- MD5 a1b7964306b99968c33ab6a7ded2bb4d
- SHA1 1ff758e1e1bca338e96151b426e10f7e24320906
- SHA512 deb9a8001a0d972881ceb6d9c22adb1927ae04751c54ef65df52ae0bbd28d94e0fc312ff239ec078061f5aa543678a6b442b295bad9cae63e45325570e6b7c62
- SSDEEP 393216:kJL9QlqkYEl5YjWuSLUxJEI0DQOnJ0z0vyoSQfTqKTh9E2uC:k5ZkX5NuSgxI3nU0dSUW6h
- TLSH T15E07334545C38A23C854F233DB755B692226BF3878E4EBF0EB289C1942E54E8D67C6F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
rickkkks-37632.portmap.host:37632
Attributes
-
Install_directory
%AppData%
-
install_file
RuntimeBroker.exe
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe family_xworm - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe unpack001/Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe unpack001/Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
File Explorer
-
Cypter Server v2.0.zip.zip 17.1MB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe.exe 417KB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Crypter.pdb39KB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Crypter.xml784B
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.config.xml 1KB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.mp416.4MB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png.png 666KB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe.exe 60KB
-
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe.exe 288KB
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 26572eb18720ec0498b293bf9259e2d797e929946b9df2bd7f78a84fd833f814
- MD5 c7b5452918278f6695ef9b489eb60787
- SHA1 d918cbe2f3f4e9d67ddead70bbf46d54c34365ce
- SHA512 637f92921a5099bf8f00ee501f41146c81b91e8429d5d85b2c4f4fb28d9ffe757ae4c965da108536ec8242a12d9dbd0a6c49b56ad419efca3bf07a8d0f62cc4d
- SSDEEP 3072:V5NryH88Ffyjy+Q0v341ZQbzILLt08+gb01zQn4jTrhhl92U0s:VDCH+7voZgU0ebIrbp
- TLSH T10C94C1952EC39671E19816F432AEEBE406677D06AC2BC67D2DF477CA37F13A085C0990
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
241246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Invalid
Size
512B
Virtual Size
10B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Wrong
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Xerin
Size
512B
Virtual Size
141B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Crypter.pdb
- SHA256 ba827bfcbc29fdd711382272cfaa90a1c295f7aaf98df3fe254e2d75e6a74105
- MD5 a2b0beea3db1ad91591b270a1b6071b2
- SHA1 ddb6d53b099d3725df36cf75adc26967d1cb65ae
- SHA512 7222cb535e5211efaffebbca5d74c0ca035f1e8e73bf1f5d2c72f591cc4ff503e6c64e3b08305ac515b7feff98a041f7b65d92e693fbac949c1708c43d6aeb02
- SSDEEP 384:aH3YtP2nphq+ct+cyaq+c5+c7r+cV5d+cAW7O4CRLxccgg1+RgT+v70/:aH3YtP2nrFvDB6
- TLSH T119033106BB44D633D1332638476FDB99523DEC409F92977BA788732E6DB230A6F52118
- MD5 SHA1 SHA512 SSDEEP TLSH
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Crypter.xml
- SHA256 c69f46c24f375edea234de2ac23d026e7344d8cefd22c4d70d3d50983941567e
- MD5 7a62e87039a6aef3e6a84d64ce8a3bbc
- SHA1 239df118d694b4cbd3fa7b4324df08e10e00546f
- SHA512 bded0068acf2a0a0971d313da44ec9fa52ca15638dfee71e4846f003097ddf14b39c0abee5033de6fae123f1d5117581f654dd9de73f0b3a7e36e74eb4d90b7a
- TLSH T10E019C8262AC6E710E73613B7D14B8C0B4074F59C868200EC4945A7317E42CBFBDFCA4
- MD5 SHA1 SHA512 TLSH
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.config
- SHA256 2726c7c722b8c87e8a9a15d7aad4d0fc80ac45de9f0e23a0ca4184d8fdae2f3b
- MD5 5083d2a1e6608c0012039fb495dcc226
- SHA1 8f362a8c816a0c3fb36bdb6fd1d7f6dcf49532f5
- SHA512 e8be604e1f9f7ede2874ca7e963cda5487e964d61529b29923820d2436a3f8155a79839dbc44d6798ffce527999cbe8e677fc5e55ca881add12bd6aedc78cb73
- TLSH T12531F356F5D00CF649A3A763BE204A41DF364E5B724D410CF8ADA68B5F3286D93033D2
- MD5 SHA1 SHA512 TLSH
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.mp4
- SHA256 6049c8e0b98adccaafe5e6fdb3db888ba3b29872c50f5f188112f4fe1a0c0f1e
- MD5 680a261c2af9f39a8f33bd4d8f33434e
- SHA1 f0e7c27f643f6dc20e83f798cddef7025caa014f
- SHA512 09b9643107cf5e0fd227f0d3b1d8f7bcdff08bbdd1dea2df3a1f1cec32154a6b3d2c57e2ebcc8d1e31cb7e80df3700e5c36b6431af15ff8a8e95e30f9963d0a3
- SSDEEP 393216:fZad2n89wH2OE+pSThdUrIYIJlZ2BLuuk0CXlL0Uv:0OW+gThyralZqLF00u
- TLSH T17C0733C046C4AA32FD75C332DDC6566B39AE1F742498DFFB726C493645A022C53ACA78
- MD5 SHA1 SHA512 SSDEEP TLSH
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
- SHA256 fea09c08245115bcac9299658926a3065fb1fb90899ba143d32c9983150205d5
- MD5 a3d7da276c97d646a582029dc93587a2
- SHA1 f42e36baea56c299ec513f86c0d259f7d81e9f88
- SHA512 c9ae34c34d729a501fa11f125532d23b02f6b169c68d98bcafba3ed7f0dab98aa8b2bec182c263de2d9de0c82a50f3b45ad3c4f8bfe987755a5bb5424aaa3304
- SSDEEP 12288:W3BNvkWEvoumAVu5Y4IiNLnp0XZuNGSIPTJAQOc0R6aTEHaQLokCiZvf:W3rvUvoumku530k9IPT+MUPAlZX
- TLSH T1A4E42369FBFABF800878DC01D819C1405BAE52281F1BBACE545FAD618C56D1CB3D7AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b082a9185b05574a00e75a6b0ca6c63a3b32567201f21a534db5e7d9c96d6eee
- MD5 0f4e37060b40ec08236f2ff7fffac768
- SHA1 9b83128951d67aa34b23f34ecc7e910d7856f1d7
- SHA512 5e931246875d37fa5a85c4bdd4269b6a8f5a94cf4c583da90023f7033762b40d01aff2f00a4b93d4edaee55cfe947c521bd0de5185ea430813d5f3a2bbc37bdf
- SSDEEP 1536:e84x0kUjROP2XHv3wZ5FzGsgbCkbfTR3cwl+puOehMi+:P4xXPoPwnFzGrukbfTG7uOeG
- TLSH T18A537C08BBE64235F4FEAFB61AF57112C678B2175923961F28C441861B23E8DCD41BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1fae8efd7307828e323e9fa7e670b8faf31f80be730c8d4731f32a107265cdc
- MD5 26c343682e8bf3a36dcdc324b5fff2c5
- SHA1 9a51630f50b6e866cfc61410aeb9ada2c09819cc
- SHA512 af46aae61869c8c8a82337209d31563146f1d31cfda98946707b1813e4d6db7fe19930f3c5a00c544363900c560205a61bbc09513de3a9adb3719dbf696d3ade
- SSDEEP 6144:1i7GRM+R19BUBS+H9Dr+kLZ7Fvgd7e+jY4HZdj8f:1aGCuzrYt+6HvMj/j
- TLSH T1F5543F9170585883E81731F1DC9FDA30225EABDF5239C70E3653FB1A5A9336620A7E4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
137886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ