520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524

Sharing

Copy URL Twitter E-mail

General

Target
520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524
Size 4.7MB
Sample261113-xnylcsfv21
SHA256 520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524
MD5 a9bdf67ea3f0b5d1030927694d6994bf
SHA1 be3891d8068f74cc2ea5ede7dbd3e84f1258e873
SHA512 c367a62e7428006e10ed118bb9fe9d258a5e5454e1f4e8c32fad495eb0aba271532b05626e6a832e781d1bca8d00f2ebfa0126c6c9de1414eb5c483907fd536f
SSDEEP 98304:s4IBb3a/a4H03oLaXEJgvn6g6BcGHvRLF:1Wn4/O9gbHX
TLSH
T14036BF207912C075D98111B189BDBFBF45BCAA141B7559C3A3C82E2E9E706C33F7299B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524

File Explorer

520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524

.exe 4.7MB

520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524

IMPHASH b34f1a786ce23ce7e92433b1877ee41f
SHA256 520a7cd572c7113060f9452dbc33baaedcb7bed27c7c48d0b2d12dfbfd5c0524
MD5 a9bdf67ea3f0b5d1030927694d6994bf
SHA1 be3891d8068f74cc2ea5ede7dbd3e84f1258e873
SHA512 c367a62e7428006e10ed118bb9fe9d258a5e5454e1f4e8c32fad495eb0aba271532b05626e6a832e781d1bca8d00f2ebfa0126c6c9de1414eb5c483907fd536f
SSDEEP 98304:s4IBb3a/a4H03oLaXEJgvn6g6BcGHvRLF:1Wn4/O9gbHX
TLSH
T14036BF207912C075D98111B189BDBFBF45BCAA141B7559C3A3C82E2E9E706C33F7299B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2438184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Moscow\Desktop\KIBRIS2 FİLES\SOURCE\FOX FS\Metin2\ServerFile.pdb

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime

d3d8

Direct3DCreate8

python27

PyEval_GetRestricted PyErr_NoMemory PyErr_Occurred PyDict_SetItem PyExc_EOFError PyString_FromStringAndSize PyComplex_FromCComplex PyFloat_FromDouble PyExc_ValueError _PyLong_FromByteArray PyUnicodeUCS2_DecodeUTF8 PyCode_Type Py_OptimizeFlag PyEval_EvalCode PyCode_Addr2Line PyObject_AsCharBuffer PyImport_AddModule PyImport_GetMagicNumber Py_FlushLine PyEval_SetTrace PyRun_StringFlags Py_Finalize Py_Initialize Py_SetProgramName PyErr_Fetch PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyObject_CallObject PyErr_BadArgument PyMarshal_ReadObjectFromString PyString_AsString PyFloat_AsDouble PyLong_AsUnsignedLongLong PyLong_AsLongLong PyCallable_Check PyObject_GetAttr PyObject_GetAttrString PyString_InternFromString PyImport_ImportModule PyErr_Print PyModule_AddStringConstant PyDict_Size PyDict_Next PyList_SetItem PyLong_FromLongLong PyInt_AsLong PyTuple_SetItem PyTuple_New PyArg_ParseTuple PyInt_FromLong PyDict_GetItemString PyTuple_GetItem PyLong_AsLong PyModule_AddIntConstant PyList_Append PyList_New PyString_FromString PyExc_RuntimeError PyErr_SetString Py_InitModule4 PyTuple_Size Py_BuildValue PyCode_New _PyLong_New _Py_EllipsisObject PyErr_Clear PyExc_StopIteration PyDict_New

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

imm32

ImmNotifyIME ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA

devil

ilDeleteImages ilEnable ilGenImages ilGetInteger ilCopyPixels ilConvertImage ilBindImage ilLoad ilOriginFunc ilInit ilTexImage ilSetPixels ilSave ilShutDown

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

imagehlp

StackWalk EnumerateLoadedModules GetTimestampForLoadedLibrary

mss32

_AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_set_sample_volume_pan@12 _AIL_end_sample@4 _AIL_resume_sample@4 _AIL_stop_sample@4 _AIL_start_sample@4 _AIL_set_sample_file@12 _AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_last_error@0 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_set_3D_sample_file@8 _AIL_set_stream_volume_levels@12 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_stop_3D_sample@4 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_close_digital_driver@4 _AIL_open_stream@12 _AIL_open_digital_driver@16 _AIL_file_type@8 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_file_read@8 _AIL_mem_free_lock@4 _AIL_start_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_close_stream@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_update_3D_position@8 _AIL_stream_volume_levels@12

speedtreert

?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z

dinput8

DirectInput8Create

ws2_32

htons connect __WSAFDIsSet ioctlsocket sendto gethostname gethostbyname ntohs ntohl inet_addr closesocket htonl WSACleanup WSAStartup WSAGetLastError socket send select recv

user32

BeginPaint EndPaint GetClientRect GetWindowLongA SetWindowLongA LoadCursorA LoadStringA RegisterClassA MoveWindow GetMenu OpenClipboard InvalidateRect SetWindowTextA GetWindowRect AdjustWindowRectEx SetRect PeekMessageA GetDC ReleaseDC GetKeyboardLayoutNameA GetKeyboardLayout GetMonitorInfoA MonitorFromPoint CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard UpdateWindow MessageBoxA PostQuitMessage IsWindow ShowWindowAsync FlashWindowEx SetWindowPos IsIconic GetAsyncKeyState SetForegroundWindow GetCursorPos ScreenToClient FindWindowA LoadIconA DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA wvsprintfA GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture SetCapture GetCapture ShowWindow ClientToScreen SetCursorPos LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState SystemParametersInfoA

gdi32

BitBlt GetPixel GetDeviceCaps TextOutA CreateDIBSection SetBkMode TextOutW SetTextColor SetBkColor GetTextExtentPoint32W GetCharABCWidthsFloatW CreateFontIndirectA EnumFontFamiliesExA GetObjectA SelectObject GetStockObject DeleteObject DeleteDC CreateCompatibleDC SetDIBitsToDevice GetTextExtentPoint32A

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear SysFreeString

shell32

ShellExecuteA SHFileOperationA SHGetSpecialFolderPathA

granny2

_GrannySetControlRawLocalClock@8 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOutCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyGetControlLocalDuration@4 _GrannySetControlSpeed@8 _GrannyGetControlSpeed@4 _GrannySetControlLoopCount@8 _GrannyGetControlLoopCount@4 _GrannyFreeControlIfComplete@4 _GrannyControlIsComplete@4 _GrannyGetMeshVertexType@4 _GrannyFreeControlOnceUnused@4 _GrannyPlayControlledAnimation@12 _GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannyGetLogMessageOriginString@4 _GrannyGetLogMessageTypeString@4 _GrannySetLogCallback@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyFreeControl@4 _GrannyGetMeshTriangleGroups@4 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyCompleteControlAt@8

kernel32

VirtualAlloc GetVersionExW UnregisterWaitEx DuplicateHandle UnregisterWait VirtualProtect SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer VirtualFree SetProcessAffinityMask CreateTimerQueue WaitForMultipleObjectsEx GetConsoleMode GetConsoleOutputCP GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle ResumeThread ExitThread GetFullPathNameW GetDriveTypeW RegisterWaitForSingleObject GetFileSizeEx ReadConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateDirectoryW DeleteFileW MoveFileExW FlushFileBuffers SetConsoleCtrlHandler CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority CreateThread SignalObjectAndWait LoadLibraryW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList LoadLibraryExW FreeLibraryAndExitThread OutputDebugStringW GetThreadTimes SetLastError WaitNamedPipeW PeekNamedPipe GetModuleFileNameW GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount FindResourceW FindResourceA SizeofResource LoadResource LockResource InterlockedDecrement HeapValidate InterlockedIncrement GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx GetFileAttributesExW GetExitCodeThread SwitchToThread WaitForSingleObjectEx CreateSymbolicLinkW GetFileInformationByHandleEx GetModuleHandleW CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle QueryPerformanceFrequency LCMapStringEx DecodePointer EncodePointer LocalFree IsProcessorFeaturePresent RtlCaptureStackBackTrace GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetCurrentThreadId TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock RaiseException FormatMessageA QueryPerformanceCounter SetFilePointerEx CreateFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateSemaphoreA SetThreadPriority ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock FreeLibrary GetVersionExA GetSystemDirectoryA GetTimeZoneInformation SetCurrentDirectoryW WriteFile SetFilePointer ReadFile WinExec GetCurrentThread SetUnhandledExceptionFilter OutputDebugStringA CreateFileMappingA UnmapViewOfFile MapViewOfFile GetSystemInfo GetFileSize GlobalAlloc GetModuleFileNameA GetTempFileNameA GetTempPathA RemoveDirectoryA DeleteFileA CreateDirectoryA AllocConsole MoveFileA GetPrivateProfileStringA OpenMutexA lstrlenA ExitProcess CreateMutexA WaitForSingleObject GetCurrentDirectoryA K32GetModuleInformation LoadLibraryA GetProcAddress GetModuleHandleA FindNextFileA FindFirstFileA FindClose MultiByteToWideChar SetFileAttributesA Sleep Module32Next Module32First ReadProcessMemory GetCurrentProcessId GetCurrentProcess GetLastError Process32Next Process32First CreateToolhelp32Snapshot OpenProcess TerminateProcess GetSystemFirmwareTable GetProcessHeap HeapFree HeapAlloc DeviceIoControl CloseHandle CreateFileA RtlUnwind GetCurrentDirectoryW SetFileAttributesW SetStdHandle HeapReAlloc GetTickCount FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize HeapQueryInformation SetEndOfFile WriteConsoleW GetNativeSystemInfo

advapi32

RegOpenKeyExW CryptGenRandom CryptReleaseContext CryptAcquireContextA RegSetValueExW RegCreateKeyExW RegOpenKeyA RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegCloseKey

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

602KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

167KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=49, id=259, version=27412,

count=213, id=261, version=27412,

count=4, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=48, version=9044,

count=36, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=5, id=261, version=30147,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=2, id=253, version=28518,

count=20, id=260, version=30034,

count=29, id=259, version=30034,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=27, id=257, version=27412,

count=578, id=1, productName=Unmarked objects,

count=2, id=262, version=27412,

count=33, id=260, version=27412,

count=154, id=261, version=30034,

count=2, id=253, version=23601,

count=45, id=265, version=30159,

count=1, id=260, version=30159,

count=312, id=261, version=30159,

count=1, id=256, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,