h6cz3u.zip
- SHA256 c3177c78177edf0575519330708ebba51dbc38c5ed7d6d949f552dac0e2c6a78
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
h6cz3u.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
h6cz3u.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
General
- Target h6cz3u.zip
- Size 3.6MB
- Sample260820-dybpssbb92
- SHA256 c3177c78177edf0575519330708ebba51dbc38c5ed7d6d949f552dac0e2c6a78
- MD5 707151ed8b00f54ca19067955dfc501d
- SHA1 ff4e0d915540f70d9d90f3380dc59960976d5479
- SHA512 e1eeaebac602be6e181e21af2d39959de7a41d19da4161e6ed5a15bc10cdd42ad3a182d3e04e9ef700558ea0bad4db557394352f21db65a952a887dda88bb7dc
- SSDEEP 98304:9MkoOgVZrMRIoe3Kv9IQC+iZAxoyJxB44vM/I6:9b1WZrMRuQef+iKmyJxk/X
- TLSH T1F4063360D8D91271FF9FAACCB973ACE9E44686F7DBAC84F6D050785A141C4C21CB94B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LycronCrypter/LycronCrypter.exe
File Explorer
-
h6cz3u.zip.zip 3.6MB
-
LycronCrypter/LycronCrypter.exe.exe 170KB
-
LycronCrypter/README.txt479B
-
LycronCrypter/config.ini130B
-
LycronCrypter/engine.dll3.0MB
-
LycronCrypter/signatures.db512KB
LycronCrypter/LycronCrypter.exe
- IMPHASH 0481a00342c232cc060f7c2b112cc99d
- SHA256 38a95a8479051a511cdfec97d7ab88ebe116ffc1a084a54888c54f1a0ac2e8a3
- MD5 9f6d6a998f90dfc89761dcbf150fc2bc
- SHA1 d0db7ea14a495468f77bccfb4526384d63aca5ba
- SHA512 140f17a4f1292819ac6de38c8afb3a5abd9057f5e9f663176f1117f5d2031b98737fa5167f8804f71598465d72d340b25232697a9ec813e1f00af243334191ff
- SSDEEP 3072:JmXlsXCel7r9+vDpf1flr+Rf5U1xbff5eLRJyxjEbCNt+FdjsZLG4T4yufbPlEGD:JYM3lXSptYRyICNt+njsc42BHwnPiaQ
- TLSH T10F040744F29E50E8E0768138A5A24751BAF37C1507645FFF06A44F6AAEE3AC07D3BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
102880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileSizeEx
GetFileType
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
GetConsoleWindow
IsValidCodePage
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockResource
MoveFileExW
MultiByteToWideChar
ProcessIdToSessionId
QueryPerformanceCounter
RaiseException
ReadFile
RemoveVectoredExceptionHandler
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcatW
lstrcmpW
lstrcpyW
lstrcpynA
lstrlenW
user32
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
wsprintfW
advapi32
ConvertSidToStringSidW
ConvertStringSidToSidW
CreateProcessAsUserW
GetSidSubAuthority
GetSidSubAuthorityCount
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
shell32
ShellExecuteExW
winhttp
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
LycronCrypter/README.txt
- SHA256 55f2a4c1e33df00875666bee506e7b92892921519265e617cea99aa9e0247bd2
- MD5 c4a0e0c40f71850e0d434a074d36ee02
- SHA1 3b297214df32ccbd2907db6b6634f0de42c8da5e
- SHA512 a39fc02740d709b5bb7ca7f9f6d1ef4dae34e669ddef8e61950a57e420ccec9612c30322e8b9c4145de8cd730376ebe3023bfebbf56e827cfc2c580c64885ddd
- TLSH T150F0DC4E76D5425286BB4CAB017197FD9527AE9CAA045E43606CC188728A86CF7A28D3
- MD5 SHA1 SHA512 TLSH
LycronCrypter/config.ini
- SHA256 b027d50ea830092b962554455fb86943658180fb33f8aae10ee292311146811e
- MD5 7403f7016f6f1ca654365f2338e6af9a
- SHA1 c7fdeab62751bf61da0e461d8e013c2696159bc8
- SHA512 47aa230637741e5be0bb5a1e5c973db9f3105eba7486d247b07a21221bbaa1b9cf9db526d20484976c6ff1a0cc50a7b1e6befdf8fb8a8aa389b4cb3cbe419574
- TLSH T138C09BA24D2145045B536A83F9F5C319D639591E495005594B618D60986D950520E566
- MD5 SHA1 SHA512 TLSH
LycronCrypter/engine.dll
- SHA256 814f02fce2f1746b30622f6bd1078a3011d997655603faab928870ccda8d621a
- MD5 d18b9c7aa953dc48ebff008a3f0ac1ff
- SHA1 bbb21896d5dc426c9c2e94bb4e6afb51953de061
- SHA512 ef7f2a9b9ca6160e4b2387f86f6f6e46ca72cea1c2496e4bc7bbb8d6bb5073b58df9c71919718d7ae2edcf75c30ecaa48c7ed597b242a41f3f57d75b41d1b48f
- SSDEEP 49152:/Myag4PhM2ySDQw1ogx+Dg/9kA5LCoAAs1d+SUyGFsSlM3O9TzCSO2kFd3oypA2c:/MyagiRZVIDg+A5WDx4y8MeLYNoyp7c
- TLSH T1D3E53360D9C402727F76EACC69B7ADDAE04B84E6EE9CC4F5F021B8A6241C0C15C794F6
- MD5 SHA1 SHA512 SSDEEP TLSH
LycronCrypter/signatures.db
- SHA256 e3278a2dfeffe4315e24ac2ddb01b0c3a3a45607235e5a87491383ea51c4fed1
- MD5 26ba5837a472df1a172dfe6c2080c79b
- SHA1 239ce955700a1309794f5c154744617ddb5fc89f
- SHA512 73e1814705c08c51d1218f0419d35dd4db3239f3e321efb9c2e6570cdd1b514263a8788ceb84a7e75f660aebecfe6db64d358d235305d42c16c7b72bef767006
- SSDEEP 12288:8r+Bzp1LQLMfmUFSHYSQRSgRcsGIEHyRmnuwcdcU94BUk5:0upVE4905f/CdcU94BUk5
- TLSH T1E9B42364C57EA9E1E1CF38DCA52358E54E11F77242AC47AF88D93D0CC812EA35CD9B52
- MD5 SHA1 SHA512 SSDEEP TLSH