API tools faq
paste
sysopfb

MAN1 crypter in CobaltGroup

sysopfb
Aug 9th, 2018
427
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.89 KB | None | 0 0
raw download clone embed print report
  1.  
  2. Code overlap being in the first layer decoded in the crypter which then loads and decodes the next layer.
  3.  
  4. Comparison of a version on a quantloader: 92e2ba2c8047648af88e89e1c7c2c07752ffb1d299674171a0836aeb9a313894
  5.  
  6. 02471220 55 PUSH EBP
  7. 02471221 8BEC MOV EBP,ESP
  8. 02471223 817D 08 10270000 CMP DWORD PTR SS:[EBP+8],2710
  9. 0247122A 76 12 JBE SHORT 0247123E
  10. 0247122C 817D 08 30750000 CMP DWORD PTR SS:[EBP+8],7530
  11. 02471233 73 09 JNB SHORT 0247123E
  12. 02471235 B8 01000000 MOV EAX,1
  13. 0247123A EB 04 JMP SHORT 02471240
  14. 0247123C EB 02 JMP SHORT 02471240
  15. 0247123E 33C0 XOR EAX,EAX
  16. 02471240 5D POP EBP
  17. 02471241 C3 RETN
  18.  
  19.  
  20. 02471250 55 PUSH EBP
  21. 02471251 8BEC MOV EBP,ESP
  22. 02471253 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  23. 02471256 3B45 08 CMP EAX,DWORD PTR SS:[EBP+8]
  24. 02471259 76 25 JBE SHORT 02471280
  25. 0247125B 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  26. 0247125E 33D2 XOR EDX,EDX
  27. 02471260 F775 08 DIV DWORD PTR SS:[EBP+8]
  28. 02471263 83F8 64 CMP EAX,64
  29. 02471266 72 18 JB SHORT 02471280
  30. 02471268 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  31. 0247126B 33D2 XOR EDX,EDX
  32. 0247126D F775 08 DIV DWORD PTR SS:[EBP+8]
  33. 02471270 3D B80B0000 CMP EAX,0BB8
  34. 02471275 77 09 JA SHORT 02471280
  35. 02471277 B8 01000000 MOV EAX,1
  36. 0247127C EB 04 JMP SHORT 02471282
  37. 0247127E EB 02 JMP SHORT 02471282
  38. 02471280 33C0 XOR EAX,EAX
  39. 02471282 5D POP EBP
  40. 02471283 C3 RETN
  41.  
  42.  
  43. To a cobaltgroup int.dll downloader: e8dc9b291ff478c6388318bebbed328523e9d5681b9acc0fb123a5e740fc4771
  44.  
  45. 002F0C90 55 PUSH EBP
  46. 002F0C91 8BEC MOV EBP,ESP
  47. 002F0C93 817D 08 10270000 CMP DWORD PTR SS:[EBP+8],2710
  48. 002F0C9A 76 12 JBE SHORT 002F0CAE
  49. 002F0C9C 817D 08 30750000 CMP DWORD PTR SS:[EBP+8],7530
  50. 002F0CA3 73 09 JNB SHORT 002F0CAE
  51. 002F0CA5 B8 01000000 MOV EAX,1
  52. 002F0CAA EB 04 JMP SHORT 002F0CB0
  53. 002F0CAC EB 02 JMP SHORT 002F0CB0
  54. 002F0CAE 33C0 XOR EAX,EAX
  55. 002F0CB0 5D POP EBP
  56. 002F0CB1 C3 RETN
  57.  
  58.  
  59.  
  60. 002F0CC0 55 PUSH EBP
  61. 002F0CC1 8BEC MOV EBP,ESP
  62. 002F0CC3 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  63. 002F0CC6 3B45 08 CMP EAX,DWORD PTR SS:[EBP+8]
  64. 002F0CC9 76 25 JBE SHORT 002F0CF0
  65. 002F0CCB 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  66. 002F0CCE 33D2 XOR EDX,EDX
  67. 002F0CD0 F775 08 DIV DWORD PTR SS:[EBP+8]
  68. 002F0CD3 83F8 64 CMP EAX,64
  69. 002F0CD6 72 18 JB SHORT 002F0CF0
  70. 002F0CD8 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
  71. 002F0CDB 33D2 XOR EDX,EDX
  72. 002F0CDD F775 08 DIV DWORD PTR SS:[EBP+8]
  73. 002F0CE0 3D B80B0000 CMP EAX,0BB8
  74. 002F0CE5 77 09 JA SHORT 002F0CF0
  75. 002F0CE7 B8 01000000 MOV EAX,1
  76. 002F0CEC EB 04 JMP SHORT 002F0CF2
  77. 002F0CEE EB 02 JMP SHORT 002F0CF2
  78. 002F0CF0 33C0 XOR EAX,EAX
  79. 002F0CF2 5D POP EBP
  80. 002F0CF3 C3 RETN
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!