c432fdcb2365b0fcc4771545def56b14abd40ceaf4adc1ce1d79aa17e1874e6b

Sharing

Copy URL Twitter E-mail

General

Target
CrypteX Advanced.rar
Size 2.6MB
Sample260812-qcqcaach34
SHA256 c432fdcb2365b0fcc4771545def56b14abd40ceaf4adc1ce1d79aa17e1874e6b
MD5 2b77ce60ecced09e0aed01250dd2e2ec
SHA1 ec3be4643b124e0e40d43ca5638252894009658c
SHA512 e9a966f89ba21c92ef562178934d7d2b641f4d5bcb418d4bad63b0d18cfbe534253f4d0abfb69719442e34f5db78ec8417bd4d07d7f8cb261fd51a4c51fff1de
SSDEEP 49152:X+BCvCtBtOL6QZ0uChpk5kRm0H1A26bhMOvz+h+utn:uJ/mHOk5J0H1Obhyh
TLSH
T16CC533CC59BF3C1348EE3FA00B3F3B37D8E6516917B7D8A5048468790DBB5A0E56A489
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CrypteX Advanced/Cryptex_Advanced-V3.0.5.exe
- Size 226KB
- SHA256 0653ac196ef55f89a855611e3bf205445317d01052afb7d062c01d360b04cebf
- MD5 f93781bbd15a4ac94e408efebbf24f14
- SHA1 5941b82d104083f1255cd6eeb251c51f84928225
- SHA512 7f69650a37222c2f036a7487c5e353103160c0db30195460e695450215b815a70d79f7ef94a0977843ffbd07a29e65b559493e7e4d5be9ac861ca12557d6fc21
- SSDEEP 3072:z4lMdB+zSSfIF18Gpt+hEjU+dTKye0VNE4+jjjjcjjjjN7uoF:z6MdkJq+hSE0VNsjjjjcjjjjE
- TLSH
  T1EB346C8CA14782A1F831EBF34496821B312C5F15EC78AE9F2547736A3AF75C4B9D1E48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  CrypteX Advanced/Mono.Cecil.dll
- Size 265KB
- SHA256 7289271edf046a1b256dae978082fd775d5d84be50d2fac7cd650de4acb7fff3
- MD5 d750c6e40c0c70bedc223d5dda891163
- SHA1 fb53b3b4db54712411a4227d9cbe413851b81fb8
- SHA512 44a96cf8d126c4342d43d8a4b51f3bf2fd1ed96ac31a4456bee5597a39da4ffa5e75696b2b5524eaf3c35b054f921afd7e822d115838b5196674d8271da27344
- SSDEEP 6144:dIdbSHG4eCGPLjtoBSX2/0NVF9SFGMLS:dIl6G42a03/SFGs
- TLSH
  T1BE446B156FFC9B2BDA8FC77BF066192C46F5E126B247CB586C9AE6790C0771188013A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  CrypteX Advanced/data/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  CrypteX Advanced/data/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral7 behavioral8
- Target
  CrypteX Advanced/data/Mono.Cecil.dll
- Size 265KB
- SHA256 7289271edf046a1b256dae978082fd775d5d84be50d2fac7cd650de4acb7fff3
- MD5 d750c6e40c0c70bedc223d5dda891163
- SHA1 fb53b3b4db54712411a4227d9cbe413851b81fb8
- SHA512 44a96cf8d126c4342d43d8a4b51f3bf2fd1ed96ac31a4456bee5597a39da4ffa5e75696b2b5524eaf3c35b054f921afd7e822d115838b5196674d8271da27344
- SSDEEP 6144:dIdbSHG4eCGPLjtoBSX2/0NVF9SFGMLS:dIl6G42a03/SFGs
- TLSH
  T1BE446B156FFC9B2BDA8FC77BF066192C46F5E126B247CB586C9AE6790C0771188013A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  CrypteX Advanced/data/ca3.exe
- Size 2.0MB
- SHA256 443c5ab7c95bbd78df4cce9a90e93a22b92f4bc1fb52de25efce12ad1d526740
- MD5 d466d130d5913adff4c069b9f2ad96a9
- SHA1 b87161dc34781720f1db51bd72f1b0d49d73c426
- SHA512 86dda6b990d69af021b38f2d2303a76e78e0d1a242cbcc56f7d931d47704f929791bb3f2a596bce45686036355c049d7e99144faf57cef8e4f2a3410bf9c92b7
- SSDEEP 49152:QcTm6VOUv9IkrhqEB9RkLF85bxXvdjTkN8Pri4Sg9/8:QcTHT9FVVRlXVTkN81
- TLSH
  T196A5337C2F4B58A5F921FCF244D78A1342B55D5E82040A1BA0BF7E0957B696FCF0A88D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Adds Run key to start application

SmartAssembly .NET packer

Suspicious use of NtSetInformationThreadHideFromDebugger

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Adds Run key to start application

SmartAssembly .NET packer

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12