Rhinoceros[.]v8[.]3[.]24009[.]15001[.]Keymaker-CORE[.]rar

resource	yara_rule
static1/unpack001/cr-keygen.exe	ConfuserEx

resource
unpack001/cr-keygen.exe

Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar

SHA256 d4d7be5087b751802ae006b5bda3ddb6700b35e4d8a9486d6f1537a6fbca770c
MD5 b6cc00ab951909462e09c357f3b6e123
SHA1 b51435dfbe43a140fdb3971d0dbcddda90d3d74a
SHA512 45ec83e6b0eae3b44abe450bca8aa61c54102c1ba5c310e90e06a0102c83cbc483c22bc24c34776fd3ce5eb063892b5fd7bc85f0dbe79eba4545e755187cd78f
SSDEEP 12288:SLO+yKMi8uBrHfpbrWrC5Mm7IpS7YVJib49aMW:S/y+HRbrMGHIpOYDib4U3
TLSH
T151842379A1C18FB30A41452C71491218CE5B7E6AAF8DBCD0E643EE6D6030EE455FD8FA
MD5 SHA1 SHA512 SSDEEP TLSH

CRACKSurl.txt

SHA256 b11ab0a1e6db7bb9b7da6a92aaaabf48627deff6cd5f6320da3709490151ef8d
MD5 90e4d146072a719c280f387b2ed4493e
SHA1 68ab0bf2670e2d027f82f153e8e7d0b7ae5fa983
SHA512 98ddb1c9b02db257daa15165187b309f93874498985f1aea3ed988e22e5110018d766eeca636bf1554a2a74a50c81a0e9186ece04a2cb8d4f80eefae97fcc457
TLSH
T19C31E502BEDC2D127D207E861A3DE0E106AA12C140394FD26B79358486CFFB97F97B51
MD5 SHA1 SHA512 TLSH

Join Telegram for more.url

SHA256 771846ab3f8c33f137024e6a13e5a41ac30a212a8076ca80d8cb96093a77da69
MD5 8e69ef0723269ec6a3f88b38f3d87cb6
SHA1 98e410c6fca03ab37d2e82bc103f499019d8d5b4
SHA512 63d3e6f00d44a243119624a09a4e3261fc114775a6fbf4d561e849905383a391dceb558f8606cad4f03682b78119c8b26e5c23141f22420aeb15b7e9f4e231d1
TLSH
T1B9B092AF4246828BD352D50A60B0F908985EBAB498E6D05C6648EEDA0C980D2C658A36
MD5 SHA1 SHA512 TLSH

core.nfo

SHA256 9d1e87fc76c0fcb8241abfd1b854f95921ecd0fc2b40cc9b5efbae2d3e1566ba
MD5 2cdacdb55f9c22846695ff225a231536
SHA1 ecf3fa996daa2fdec8b30311b36e106bc63360e7
SHA512 389cc6603b21d3b7aafe843b9e2b847deb4d0235f9fe9ac1c387eeb7eaab4ede7c6b74db6486e198aaf652c8e87983bca27193c80ed61b0eb5f5c87b9204000a
SSDEEP 96:dn4RcuF7sQq0envwH4fOmuL1I7LTxa18GP2rFDZICP1P34PrPuoRLnj9bK:dn46uxsloH0jSidq8GerUCP1y5JVK
TLSH
T14742650787A8FAFE4F72629414D51380F6D7758F233919B0701E107A7BA72B642FDA62
MD5 SHA1 SHA512 SSDEEP TLSH

core.ru.do

SHA256 434fcc192592c35d438ea9d7a7ed01cea6fa172d8f65489ed4dcb62b7344e98f
MD5 a610698224bf8cbe9d180a70a2669ee6
SHA1 00b1dfcf6118c3a6e2a703484e41f191f6efd43c
SHA512 49fc9f1b90bcafb37cd0528e0d94a66eb830d9386c8b9fe7b72ba19c06e735f5550bffa21d09a829e78b61a296cbc5cf129bc64dcdb3d2180bcb591bdd0511b0
TLSH
T187517303A78873390FF302AB390D11D6EE661EAD371940A07968406C2B7926563BA2D9
MD5 SHA1 SHA512 TLSH

cr-keygen.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1f02437b3b6fcac0777cd20cecfafdcf169157aa2a6098a99de7c54b1a33d296
MD5 a2d2ce589f45f848dd86f3bf2e335bbf
SHA1 d5c74bdc11c358945b3765230244e78c78051509
SHA512 b3d9003f4d9cefd21e5563b26326477ecf76c7f3cc0e43b75ee5bd84012660c038e26cf21a160f756a1ce1077f90b516036b37d40e9b1013e4d8a25246b36553
SSDEEP 12288:Re2G0n5bs6mh7PRWNra7O/6J5n+4ykKbyog:Re2GObs6mhUl0n+4
TLSH
T10DB4DF4DB79475DFCADAC676D9950CA0ABB07876230B934360631AFC9F1E293DE040A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

387703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

file_id.diz

SHA256 bc041619e419d9534de97fc2c92d1ad81eec4e6bdd8f744f85d84107c8893a09
MD5 7174893def2b97647e53db38d8b94c09
SHA1 30e9aefa66f60409450f9f1caada180e67859f75
SHA512 a2edd71f1e34fac5dbf13d74b2417e1bdb3d4e9f363b79e59813c3520837672b5ec3499f828cff0ed73adbcc7c73520242a2b831296f1ce0c17990f75d31ea76
TLSH
T195E017165C12E1061A49F8F05E4FFB2F82022AE3C317696AB36C0278DB097C6696F0C7
MD5 SHA1 SHA512 TLSH

Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar

CRACKSurl.txt

Join Telegram for more.url

core.nfo

core.ru.do

cr-keygen.exe

mscoree

dotnet

file_id.diz

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar

CRACKSurl.txt

Join Telegram for more.url

core.nfo

core.ru.do

cr-keygen.exe

mscoree

dotnet

file_id.diz