71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0

Sharing

Copy URL Twitter E-mail

General

Target
71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0
Size 472KB
Sample260920-d4ryzaef64
SHA256 71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0
MD5 fd817dc77de1f44a00347b76c5eabcdd
SHA1 4e48d33a48f1fcbf4dbf8c01f94b2332e7d6bf16
SHA512 e50f5f467340ea062928a18a57be552aa3a16e4bb8e28483a6b4c98efcc22f7447163bd7806d23ff96bee0d78fc5af2af10afc482437a252346cec070b32e4dc
SSDEEP 12288:t89DMx7NQXtweW/WPwcq4888888888888W88888888888Vf:t4w+FTf
TLSH
T125A49661E972FF26C74B243A64589C6F89475E180CE5872ECB60FB0D453BBC0477E1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0

File Explorer

71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0

.exe 472KB

71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0

IMPHASH 1e8a809e0505b426516db96be454b4f8
SHA256 71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0
MD5 fd817dc77de1f44a00347b76c5eabcdd
SHA1 4e48d33a48f1fcbf4dbf8c01f94b2332e7d6bf16
SHA512 e50f5f467340ea062928a18a57be552aa3a16e4bb8e28483a6b4c98efcc22f7447163bd7806d23ff96bee0d78fc5af2af10afc482437a252346cec070b32e4dc
SSDEEP 12288:t89DMx7NQXtweW/WPwcq4888888888888W88888888888Vf:t4w+FTf
TLSH
T125A49661E972FF26C74B243A64589C6F89475E180CE5872ECB60FB0D453BBC0477E1AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress AddAtomA CloseHandle CompareFileTime CreateDirectoryW CreateEventA CreateEventW CreateFileW CreateMutexA CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateSemaphoreW DeleteCriticalSection DeleteFileW DosDateTimeToFileTime DuplicateHandle EnterCriticalSection ExitProcess FileTimeToDosDateTime FileTimeToSystemTime FindAtomA FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetAtomNameA GetCommandLineW GetConsoleTitleA GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileSize GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcessHeap GetProcessTimes GetProcessWorkingSetSize GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadPriority GetThreadTimes GetTickCount GetVersionExA GetVersionExW GetWindowsDirectoryW GlobalMemoryStatus GlobalMemoryStatusEx InitializeCriticalSection InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedExchange InterlockedIncrement LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MoveFileW MultiByteToWideChar OpenThread OutputDebugStringA PulseEvent QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResetEvent SearchPathW SetConsoleCtrlHandler SetConsoleTitleA SetConsoleTitleW SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFilePointer SetFileTime SetLastError SetThreadPriority SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrlenW RtlFillMemory GenerateConsoleCtrlEvent GetComputerNameExW WaitNamedPipeA GetPrivateProfileStringW GlobalAlloc GlobalFree CreateRemoteThread DeviceIoControl RaiseException MoveFileExW DeleteAtom FindAtomW AddAtomW GetAtomNameW CreateMutexW GetFileSizeEx FindResourceExW LocalFileTimeToFileTime CreateFileA FlushFileBuffers WriteConsoleW SetFilePointerEx GetConsoleMode FindResourceW ReadConsoleW LoadResource LockResource SizeofResource RtlUnwind UnhandledExceptionFilter GetConsoleCP OutputDebugStringW IsProcessorFeaturePresent IsDebuggerPresent LCMapStringW DecodePointer EncodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType GetStringTypeW GetModuleHandleExW GetCPInfo GetOEMCP GetACP IsValidCodePage SetStdHandle HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize

user32

GetKeyState GetDesktopWindow GetMessagePos PaintDesktop VkKeyScanW IsCharAlphaA IsMenu GetClipboardData GetDialogBaseUnits GetWindowTextLengthA CharUpperA OemKeyScan IsGUIThread IsIconic GetDC GetAsyncKeyState GetClipboardSequenceNumber LoadCursorFromFileA DestroyCursor EnumClipboardFormats CharLowerA LoadIconA CharToOemBuffA CharToOemBuffW CharToOemW CharUpperW ExitWindowsEx FindWindowA GetActiveWindow GetCapture GetCaretPos GetClipboardOwner GetClipboardViewer GetCursorPos GetFocus GetInputState GetMessageTime GetOpenClipboardWindow GetProcessWindowStation GetSystemMetrics MessageBoxA OemToCharBuffA OemToCharBuffW OemToCharW DefWindowProcW WaitMessage TileChildWindows GetClassInfoExW InvalidateRgn UnregisterDeviceNotification GetCaretBlinkTime ChildWindowFromPointEx CreateWindowStationA MapVirtualKeyExW CopyAcceleratorTableA CharUpperBuffA SwitchDesktop SetDlgItemTextA DdeConnect GetScrollBarInfo InvertRect GetKeyNameTextA DdeGetLastError GetAltTabInfoA SetProcessWindowStation RegisterClassW RegisterDeviceNotificationA EnableMenuItem SendMessageCallbackW GetDoubleClickTime OpenWindowStationA PeekMessageA RemovePropW NotifyWinEvent DrawStateW ReuseDDElParam VkKeyScanExA TranslateMessage MapVirtualKeyW AnimateWindow PostThreadMessageW SendMessageTimeoutW FindWindowW IsWindow GetMessageW DispatchMessageW KillTimer MonitorFromRect SetTimer

gdi32

GetStockObject GetStretchBltMode CreateCompatibleDC RealizePalette GetDCBrushColor UnrealizeObject GetLayout GetTextAlign GetPixelFormat GetEnhMetaFileW CreateMetaFileW DeleteObject GetEnhMetaFilePaletteEntries SetWindowOrgEx RectVisible CreateBrushIndirect SetDIBits GetStringBitmapA CreateFontIndirectW GetMetaFileA GdiAddGlsRecord GetMetaFileBitsEx GdiGetSpoolFileHandle EngDeleteClip GdiDeleteSpoolFileHandle GetHFONT GdiRealizationInfo GdiComment GdiEntry4 GdiEntry14 RemoveFontResourceA EngPlgBlt PATHOBJ_bEnumClipLines GetWorldTransform CreateHalftonePalette CLIPOBJ_ppoGetPath GdiPlayJournal GetGlyphIndicesW LPtoDP DPtoLP GdiGetLocalBrush GdiCreateLocalMetaFilePict GetFontResourceInfoW DeleteColorSpace

advapi32

RegQueryValueExA RegOpenKeyA RegOpenKeyExW RegCloseKey RegQueryValueExW RegEnumKeyExW RegOpenKeyW

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW SHIsFileAvailableOffline SHCreateDirectoryExA SHGetSettings SHInvokePrinterCommandA FindExecutableA ShellExecuteW SHGetDataFromIDListA SHGetDiskFreeSpaceA SHGetFolderLocation SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize PropVariantClear CreateStreamOnHGlobal

oleaut32

SysAllocString SysAllocStringByteLen SysStringByteLen VariantClear VariantCopy

shlwapi

StrChrIA StrChrW SHGetValueW SHGetValueA SHStrDupW PathCombineW PathRemoveFileSpecW PathFileExistsW

ws2_32

closesocket recv send

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

71d4582cb1d73fdee9b7da574787aa2029ff6ac34b8737c97477afb4c2206df0

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

imm32

generic