crystalshell | 3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9

Sharing

Copy URL Twitter E-mail

General

Target
3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9
Size 9.2MB
Sample260910-lent1s1dmb
SHA256 3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9
MD5 3cf6bc05a246ddb7bf875381a9bdf7d4
SHA1 7d55e0fb51f589d8acb68859c0b0e078cd65a2b6
SHA512 8b9de045ab3d12dc35899801bd6cd1071311172fcc9bd4fb217db35d5226d45e8162f8339d046b41745f4df09b81cdd497930557a065c727983c22551df03429
SSDEEP 98304:N2X1tJkMs2Fd+KhtaryMDsSYjwBHUZy+FMBAUZLt4Igc:N22Ms3CtaryMDsSawFIyjVy0
TLSH
T1D3A68D6AB2B900D9D86BC178C2965323E671BC554B7067CF1AA4A7B51F73AE01F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt apt36 transparent_tribe backdoor rat crystalshell

Malware Config

Signatures

Family: CrystalShell
CrystalShell is a remote-shell backdoor written in the Crystal language, used by APT36 aka Transparent Tribe.
backdoor rat crystalshell

Detects CrystalShell Backdoor 1 IoCs

apt apt36 transparent_tribe

resource	yara_rule
sample	family_crystalshell

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9

File Explorer

3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9

.exe 9.2MB

3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9

IMPHASH 2230c6c8005e0dd1d4fa188a984da132
SHA256 3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9
MD5 3cf6bc05a246ddb7bf875381a9bdf7d4
SHA1 7d55e0fb51f589d8acb68859c0b0e078cd65a2b6
SHA512 8b9de045ab3d12dc35899801bd6cd1071311172fcc9bd4fb217db35d5226d45e8162f8339d046b41745f4df09b81cdd497930557a065c727983c22551df03429
SSDEEP 98304:N2X1tJkMs2Fd+KhtaryMDsSYjwBHUZy+FMBAUZLt4Igc:N22Ms3CtaryMDsSawFIyjVy0
TLSH
T1D3A68D6AB2B900D9D86BC178C2965323E671BC554B7067CF1AA4A7B51F73AE01F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects CrystalShell Backdoor

apt apt36 transparent_tribe
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d3:23:1e:94:92:76:00:f4:d5:ae:0b:aa:2e:93:3f:e0:0b:6b:cb:3d:dd:3f:bb:44:d6:c0:6a:0d:ea:30:41:20

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 9, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:53:e3:83:de:96:de:c5:6e:cc:00:00:00:00:02:53

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:97:03:cf:59:9c:6b:89:78:3f:00:01:00:00:01:97

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

5702580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

discord_cmd_bot.pdb

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertOpenSystemStoreW

ntdll

RtlNtStatusToDosError RtlCaptureContext RtlVirtualUnwind

advapi32

CryptDestroyKey CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash SystemFunction036 RegOpenKeyExW RegQueryValueExW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptExportKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptDecrypt

ws2_32

WSASend WSARecv closesocket WSAIoctl WSAStartup WSAGetLastError socket WSAGetOverlappedResult GetAddrInfoExW sendto recvfrom getpeername shutdown listen accept send recv WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr htons htonl WSACleanup gethostbyname select ntohs getsockname ioctlsocket getsockopt WSASocketW GetAddrInfoExCancel FreeAddrInfoExW setsockopt connect bind GetAddrInfoExOverlappedResult

kernel32

GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP FindFirstFileExW OutputDebugStringW SetStdHandle FlushFileBuffers GetFileSizeEx HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetCPInfo GetCommandLineW GetCommandLineA FreeLibraryAndExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler ExitProcess IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile InitializeCriticalSectionAndSpinCount InitializeConditionVariable IsValidCodePage GetConsoleCP SetConsoleCP GetConsoleOutputCP SetConsoleOutputCP GetNativeSystemInfo AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentProcessId GetSystemTimePreciseAsFileTime GetCurrentProcess GetCurrentThread SetLastError GetEnvironmentVariableW GetLastError FormatMessageW GetModuleFileNameW GetFullPathNameW CreateFileW DeviceIoControl CloseHandle GetCurrentDirectoryW GetFileInformationByHandleEx GetStdHandle WriteFile DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS GetCurrentThreadId LeaveCriticalSection ReadConsoleW PostQueuedCompletionStatus GetProcessHeap SetThreadDescription WideCharToMultiByte GetConsoleMode SetConsoleMode GetFileType DuplicateHandle CreateIoCompletionPort LoadLibraryExW GetProcAddress CreateWaitableTimerExW VirtualFree SetFilePointerEx GetOverlappedResult CancelIoEx QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer GetQueuedCompletionStatusEx CancelWaitableTimer VirtualAlloc ReadFile WakeConditionVariable SetFileCompletionNotificationModes GetFileAttributesW SetFileAttributesW RemoveDirectoryW DeleteFileW GetDynamicTimeZoneInformation GetFileAttributesExW FindFirstFileW FindClose GetFileInformationByHandle CreateNamedPipeA CreateProcessW ReOpenFile CreateJobObjectW SetInformationJobObject AssignProcessToJobObject ResumeThread GetExitCodeProcess WaitForSingleObject FindNextFileW SetCurrentDirectoryW GetTempPathW GetModuleHandleExW Sleep GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetSystemInfo VirtualProtect VirtualLock SwitchToFiber DeleteFiber CreateFiberEx MultiByteToWideChar GetModuleHandleW GetSystemTimeAsFileTime GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW ReadConsoleA GetSystemTime SystemTimeToFileTime ReleaseMutex CreateMutexA DebugBreak SetEvent ResetEvent CreateEventA CreateThread ExitThread GetExitCodeThread SuspendThread GetThreadContext VirtualQuery GetModuleHandleA GetProcessAffinityMask GetEnvironmentVariableA CreateFileA SetFilePointer InitializeCriticalSection GetTickCount GetModuleFileNameA SetUnhandledExceptionFilter GlobalAlloc GlobalFree InitializeSListHead GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx GetCurrentThreadStackLimits RtlUnwind

dbghelp

SymInitializeW SymFromAddrW SymGetModuleBase64 SymGetModuleInfoW64 SymGetLineFromAddrW64 SymSetOptions SymGetOptions StackWalk64

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW

Sharing

General

Malware Config

Signatures

File Explorer

3551548b6abc5f54b4e4432295ad501b9e09d6ab59b144518d76780abc0b3fc9

PE Signature issue

crypt32

ntdll

advapi32

ws2_32

kernel32

dbghelp

user32

generic