Severity
Medium
Analysis Summary
Packers are often used to hide the functionality of executable files from unwanted observers. This can be done for legitimate purposes, such as protecting your intellectual property, but also for malicious purposes; for example, hiding malicious content from security products. Hiding malicious contents in packers are usually not available on company’s website but on hacking forums and not so open for the public.
NTCrypt, sold on hacking forums and web sites are generally created for malicious purposes. ReversingLabs used their own product to try to search for it on the Internet. One sample they found had “Only for malicious use!” within the version info of the binary. Most of the samples the tool discovered were PE types (compiled executables). They did come across one that was a PE/.NET type. Tracking it, they encountered videos taken of the packer in use. While the PE versions appeared to execute without any visible outcome, the PE/.NET version actually presented a user interface. This allowed them to experiment with the interface and see how NTCrypt functions.
Impact
Hiding malicious content
Indicators of Compromise
SHA-256
- 8de7b513d770188e3c99828605d04cfd1e232d40151089c300c407986d098706
- 5ea79e0706c036fb75734ef80825af4c8105214ffe3bcabe12dce1528c56201d
- 6bbf873b3a409304993867b86c542cdc6c934dea7a70eca540e9c6521b8f83a7
- 200c14ac227451eb8c74a208d4f61650467a664d228f0e978a10ee4b53d742b9
- 0bc4545faff1c9379f727f5bef8eea7d7009d5e80f0d6dc99112abe796fc2327
- 96839a8229d09359724f9c361a1ef9f6ba8cf4af298062369aa0a0d4e1069715
- 2013f629eb39c967d3b7cf35f4f90c5704205faa96a1df8520c334fe44c625aa
- 7773d517b5f3dda8db812f16f6b9a916e1a6aadb5b4a99ec98f9492547e72945
- 23232211bb692367b59c2057cd931198821565dee963398d5fa2f0da92f4de21
- 959269be199a17991ccf25d03f31a81bc5772673d7b8b6b680e102242dae0b35
- 44d84faec91b8939d3998f33e3602fa0e0ad5247975bcbc42c2016bb9ebd5fc2
- B2b16b16b63ab5f91e84e4bd84617cdd4c2657bb6cf2765c302db508805f46db
- 08edf586451da1d374517d4c13489d40c675926a4026ba99204b9f2323ea6a69
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.