jaffacakes118_shellter[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_shellter.7z
Size 4.0MB
Sample260912-e77n9sdd24
SHA256 f9e53fddd1ca81034c63086a13c3eca134062c272e70b34d11b478dd7c8885c2
MD5 b2a3bee76bdccc8185226eb9520334f2
SHA1 395e246bf2130256b598f69692bce6b7506e8d53
SHA512 897ae993781f6a37adc348ec35f35138c8996389c5586588ee50fe54dd705d085ddb1f2a80adac35f2d9895245185f907842c64f91cb955a1a75943bcee45125
SSDEEP 98304:zoTJum8VIdyg8Sq4G4P8zXg77kdN7VENYRkwdE+n8Q:zoTJuqtpq4Rl7AqksQ
TLSH
T144163331CA279264667EAF8E833C5E04E0D7008510EB64EDDDD8589DBBAFCD506F462B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
static1/unpack001/shellter.exe	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/shellter.exe

File Explorer

jaffacakes118_shellter.7z

.7z 4.0MB
shellter.exe

.exe 12.3MB

jaffacakes118_shellter.7z

SHA256 f9e53fddd1ca81034c63086a13c3eca134062c272e70b34d11b478dd7c8885c2
MD5 b2a3bee76bdccc8185226eb9520334f2
SHA1 395e246bf2130256b598f69692bce6b7506e8d53
SHA512 897ae993781f6a37adc348ec35f35138c8996389c5586588ee50fe54dd705d085ddb1f2a80adac35f2d9895245185f907842c64f91cb955a1a75943bcee45125
SSDEEP 98304:zoTJum8VIdyg8Sq4G4P8zXg77kdN7VENYRkwdE+n8Q:zoTJuqtpq4Rl7AqksQ
TLSH
T144163331CA279264667EAF8E833C5E04E0D7008510EB64EDDDD8589DBBAFCD506F462B
MD5 SHA1 SHA512 SSDEEP TLSH

shellter.exe

IMPHASH 0f499c456d4bd61253d84103a75aa495
SHA256 fa03c2c6c46ec159d210bdf7d25bcceac44906ac773766db11621e581e2d1458
MD5 ab6f046c69e782d452bce8733936eab7
SHA1 dfb5680165c9f390b603f83a3b155426429aed66
SHA512 efb874a3f63d397ce43eec728a2336e59cb4dd589217d8321995bd124d4017b9e9eedcad4e82adfeb5af1eaffd3ef473dad61a1a1f202e37e0a7906c6fef7cad
SSDEEP 393216:5YeVUHfzPzMD8CrhKSFW9z7krQi/nCr6lgT3n+:5YeqHfzD7pGgTX
TLSH
T148D68D63A24244B1D45330BEC836DAAE5068AE65477414CB62D87D1BB273FC3A93D78F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7709051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FlashPlayer.pdb

oleaut32

SysAllocString SysFreeString

kernel32

GetCommandLineW DeleteFileW SetEndOfFile WriteFile CreateFileA GetFileAttributesA GetModuleFileNameA CreateFileW GetFileSize SetFilePointer ReadFile CloseHandle GetModuleHandleA GetSystemInfo SwitchToThread TlsGetValue TlsSetValue GetCurrentThreadId LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement InterlockedIncrement InterlockedExchange InterlockedCompareExchange SetEnvironmentVariableA CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA GetLocaleInfoA SetStdHandle InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA IsValidCodePage GetOEMCP HeapCreate GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA TerminateProcess GetStdHandle HeapReAlloc UnhandledExceptionFilter ExitProcess RtlUnwind GetStartupInfoA IsProcessorFeaturePresent GetProcessAffinityMask HeapSize HeapFree GetProcessHeap HeapAlloc EnumSystemLocalesW GetUserDefaultLCID GetTimeFormatW GetDateFormatW CompareStringW GetCurrencyFormatW GetNumberFormatW VirtualProtect CreateSemaphoreA GetStartupInfoW GetCommandLineA Sleep GetCPInfo GetACP IsDBCSLeadByte DeviceIoControl CreateProcessA GetTempPathA FindNextFileW GetModuleFileNameW GetTempFileNameW GetSystemDirectoryW GetSystemWow64DirectoryW ExpandEnvironmentStringsA WideCharToMultiByte MultiByteToWideChar lstrlenW GetLongPathNameW FindClose GetTempPathW CreateProcessW GetTempFileNameA CreateDirectoryA DeleteFileA GetFileAttributesW GetProcAddress GetModuleHandleW GetLastError CreateMutexA FindFirstFileW SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetFileInformationByHandle GetVolumeInformationW MoveFileExW GetCurrentDirectoryW SetCurrentDirectoryW RemoveDirectoryW GetFullPathNameW ExpandEnvironmentStringsW OutputDebugStringA CreateDirectoryW LoadLibraryA FreeLibrary GetVersionExW GetCurrentProcess LoadLibraryW VirtualQuery ExitThread GetUserDefaultLangID GetUserDefaultUILanguage VerifyVersionInfoW VerSetConditionMask GlobalFree CreateThread LockResource LoadResource FindResourceExA FindResourceExW GlobalAlloc GlobalUnlock GlobalLock QueryPerformanceCounter QueryPerformanceFrequency GlobalSize QueueUserAPC OpenThread SleepEx SetUnhandledExceptionFilter GetCurrentProcessId GetProcessTimes RaiseException WaitForSingleObject FlushInstructionCache SetLastError TerminateThread CreateEventW SetEvent ResetEvent WaitForMultipleObjects CreateWaitableTimerW GetTickCount SetThreadPriority GetTimeZoneInformation GetSystemTime SystemTimeToFileTime GetLocaleInfoW LCMapStringW GetSystemDirectoryA GetExitCodeThread DuplicateHandle GetCurrentThread MapViewOfFile UnmapViewOfFile CompareFileTime LocalFree ReleaseMutex CreateFileMappingA ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask CreateEventA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer InterlockedExchangeAdd GetVersionExA GetVersion VirtualAlloc VirtualFree CopyFileW FlushFileBuffers GlobalMemoryStatusEx DebugBreak IsDebuggerPresent GetSystemTimeAsFileTime SetSystemTime FileTimeToSystemTime TlsAlloc TlsFree ResumeThread

user32

SetWindowTextA LoadStringA GetDlgItem EndDialog DialogBoxParamW LoadStringW InvalidateRect InsertMenuA InsertMenuW RemoveMenu GetSubMenu GetMenu UpdateWindow ShowWindow GetDlgItemTextA GetWindowTextLengthA GetDlgItemTextW EnableWindow GetWindowTextLengthW SetFocus SetDlgItemTextA SetDlgItemTextW GetMessageW DispatchMessageW TranslateMessage TranslateAcceleratorW LoadAcceleratorsW GetMenuStringA GetMenuStringW DestroyWindow GetDoubleClickTime WaitForInputIdle GetForegroundWindow SetWindowLongW InflateRect GetSystemMetrics SetRect PtInRect SystemParametersInfoW SendInput SetPropW GetPropW DestroyIcon GetCursor SetCursor SetRectEmpty GetKeyState PostMessageW GetMonitorInfoW MonitorFromWindow ClientToScreen CreateIconIndirect SendMessageW SendMessageTimeoutW GetParent SetWindowTextW LoadIconW GetDesktopWindow DialogBoxIndirectParamW RedrawWindow GetClientRect ScreenToClient MessageBoxA KillTimer SetTimer GetQueueStatus PeekMessageW GetWindowLongW CheckMenuItem GetFocus CopyRect GetWindowInfo LoadCursorW GetWindowTextA GetCursorPos EnumWindows GetCapture CallWindowProcW SetCapture GetMessageTime ReleaseCapture TrackMouseEvent SetCursorPos RegisterClipboardFormatW CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetClipboardData EmptyClipboard MoveWindow MapWindowPoints GetActiveWindow FlashWindowEx SetMenu GetSystemMenu IsZoomed GetWindowPlacement SetWindowPlacement IsWindowVisible ShowWindowAsync GetClassInfoExW IsIconic IsWindow EnumDisplaySettingsW EndPaint BeginPaint GetWindowTextW RegisterClassExW CreateWindowExW DeleteMenu LoadMenuW RegisterClipboardFormatA GetClipboardFormatNameA InsertMenuItemW CreateMenu GetMenuItemInfoW DrawMenuBar SetMenuItemInfoW SetMenuInfo DestroyMenu TrackPopupMenu CreatePopupMenu CloseWindow ShowCaret CreateCaret DestroyCaret SetCaretPos OffsetRect DdeUninitialize DefWindowProcW DdeDisconnect DdeFreeStringHandle DdeConnect DdeCreateStringHandleA DdeInitializeW CharLowerW CharUpperW MapVirtualKeyW GetKeyboardLayout ActivateKeyboardLayout EnumDisplayDevicesA UpdateLayeredWindow GetWindowThreadProcessId EnumDisplayDevicesW PostThreadMessageW CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DefWindowProcA GetWindowLongA SetWindowLongA PostMessageA RegisterWindowMessageA EnableMenuItem PostQuitMessage UnregisterClassA GetWindow GetWindowRect GetDC ReleaseDC SetWindowPos MessageBoxW DdeClientTransaction

gdi32

CreateDCA DeleteObject CreatePalette DeleteDC GetICMProfileA EnumFontFamiliesExW GetFontData StretchDIBits RestoreDC SaveDC SelectClipPath PolyBezierTo SetPolyFillMode EndPath BeginPath EndPage StartPage FillPath GetDeviceCaps GetSystemPaletteEntries GetTextAlign BitBlt ExtCreatePen StrokePath CreateSolidBrush Rectangle EndDoc StartDocW LPtoDP GetStretchBltMode CreateCompatibleBitmap SetStretchBltMode StretchBlt GdiAlphaBlend GetWorldTransform SetGraphicsMode SetWorldTransform GetTextCharacterExtra DPtoLP EnumFontFamiliesA GetCurrentObject CreatePen MoveToEx LineTo SetTextCharacterExtra GetBkColor SetBkColor SelectClipRgn GetTextColor GetBkMode SelectObject SetBkMode SetTextAlign CreateRectRgn GetClipRgn IntersectClipRect CreateFontIndirectA SetTextColor GetTextExtentPoint32W ExtTextOutW ExtTextOutA EnumFontFamiliesW GetTextExtentPoint32A GetTextMetricsW GdiFlush GetClipBox SelectPalette RealizePalette CreateFontIndirectW CreateDIBSection CreateBitmap SetPixel GetStockObject GetObjectW CreateCompatibleDC

comdlg32

GetOpenFileNameW GetSaveFileNameW PrintDlgW CommDlgExtendedError

shell32

SHGetSpecialFolderPathW SHGetDiskFreeSpaceExW SHGetFolderPathA SHGetPathFromIDListW DragQueryFileW DragQueryFileA DragAcceptFiles SHBrowseForFolderW SHGetFolderPathW SHGetSettings SHGetFolderLocation SHAppBarMessage

ws2_32

WSAAddressToStringA ntohl WSACleanup WSAStartup select ioctlsocket closesocket WSAAsyncSelect WSAGetLastError WSAIoctl socket WSASocketW inet_addr gethostbyname inet_ntoa htonl getservbyname htons gethostbyaddr ntohs getservbyport WSASetLastError gethostname setsockopt recv send getsockname WSACloseEvent recvfrom sendto bind WSASocketA WSACreateEvent WSAEventSelect WSAEnumNetworkEvents connect

shlwapi

StrRStrIW StrStrIW

mscms

DeleteColorTransform CloseColorProfile TranslateBitmapBits OpenColorProfileW CreateColorTransformW

wininet

InternetReadFile InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetCloseHandle HttpQueryInfoA

crypt32

CertCompareCertificate CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CertVerifySubjectCertificateContext CertCreateCertificateContext CryptGetMessageCertificates CryptVerifyMessageSignature CertAddStoreToCollection CertVerifyRevocation CertVerifyTimeValidity CertEnumCertificatesInStore CertAddCertificateContextToStore CertCompareCertificateName CryptFindOIDInfo CertRDNValueToStrW CertFindRDNAttr CryptDecodeObjectEx CertNameToStrW CertOpenStore

urlmon

CopyStgMedium

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoSizeA

winmm

waveInGetDevCapsA mixerGetID waveInOpen waveInPrepareHeader waveInReset waveInUnprepareHeader waveInClose waveInStop waveInAddBuffer waveInStart waveInGetNumDevs waveOutGetNumDevs waveInGetDevCapsW waveOutGetDevCapsA waveOutMessage waveOutOpen waveOutClose waveOutReset waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite timeGetTime timeSetEvent timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod mixerOpen waveInGetPosition mixerGetControlDetailsA waveInMessage mixerClose mixerGetLineControlsA mixerGetLineInfoA mixerGetDevCapsA waveOutGetPosition mixerSetControlDetails waveOutRestart waveOutPause waveOutGetDevCapsW

dsound

ord8 ord1

dinput8

DirectInput8Create

advapi32

CryptEncrypt CryptDecrypt RegSetValueExW RegQueryValueExW RegOpenKeyExA CryptReleaseContext CryptGenRandom CryptAcquireContextW RegOpenKeyA CryptCreateHash CryptAcquireContextA CryptDestroyHash CryptHashData CryptGetHashParam CryptSetKeyParam CryptImportKey CryptDestroyKey RegSetValueExA RegQueryValueExA RegCloseKey RegCreateKeyExA RegOpenKeyExW RegCreateKeyExW

ole32

OleIsCurrentClipboard OleGetClipboard OleInitialize CoSetProxyBlanket CoInitializeEx CoTaskMemAlloc MkParseDisplayName CreateBindCtx PropVariantClear OleFlushClipboard OleSetClipboard OleUninitialize ReleaseStgMedium CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

792KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=150, version=20413,

count=61, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=30, productName=Unmarked objects (old),

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=33, id=123, productName=VS2005 build 50727, version=50727,

count=629, id=1, productName=Unmarked objects,

count=12, id=109, productName=VS2005 build 50727, version=50727,

count=409, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1098, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=2, id=151,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,