ekstre[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

ekstre.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
MD5 08f1f60ad0273992c1ddb62bc12dd7b5
SHA1 8c99f783c4ca334c45e74d9b38d2da88853593b8
SHA512 a742f268d5693d75db9ecb456a3b91be16db31c6552f2a72ff481288646c856dca0b9fc6268f9bc299a1f3ccbecdb6997bfb05de350b8ae40b00f11f2803892c
SSDEEP 12288:Ul1vJDJKWMN1JSqHXe6smw9qG0QY5sM9Hws8CYb7pjPDdtGzU4PW/:Ul1vbKWcrYqGgJwjr7pPhtwUt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e8:59:5d:60:66:8f:dd:3b:0a:e2:1f:6e:ea:81:08:82:2a:a6:5a:9a:d8:a6:6d:af:d4:87:05:47:39:fb:40:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ulstered,OU=Chichling Afbrydes\ ,O=Ulstered,L=Bryn,ST=Wales,C=GB,1.2.840.113549.1.9.1=#0c17486f726e7461696c3232334049736c616e6472792e486f

Chains

Feb 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Fatteevnernes/Lysbilledapparater/posekikkeris.blu

SHA256 2cb1db9035b8795e88322c08061a7967e801ab0437b2b08beb4ef3000ad81f39
MD5 05171ec7472eac523b22ea5639bccc59
SHA1 29e90159fadac8d3b0f6ff862a20779d4d4bc6d1
SHA512 239497390f532b8a422a73745eec7a4160ed991598b22faadc92a173fdf368ccbd611f8a1a8895c20b527dc7013ebd6a17ab35f32c7685d7d96ab49c43bffaef
SSDEEP 768:oEyCi/3RCxdaooeJiacnAgrNLMFlUPGKgnVwpJm:Jipgd9XA3CFWPLGwm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Holdouts90.Mis

SHA256 469e600ecc6c693c22125f2d33f7807c74ffd66e404c1d2890a97a9880193740
MD5 03005784a48b3b8a1dd7c4673463d75e
SHA1 30af2509d4864a4eb1d38d5a7eb25680cb01007a
SHA512 08078f53235938e49eca23c647e3b67ef1a6a55c7f0fe2a4e506cbdfb5f4ff8a5d209ff4320801bd67bd10f15be661b9d52ac85b8dd0aaba34151310f85327e4
SSDEEP 6144:HMWsxbmVaQDuTNcrbJ3XtfeWyq0oOWbWzFGDo:s2FoUJ3XQ1+OrG8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lovliggrelser/Sektionerer/Cupidon/Kobolt.Gla

SHA256 463f10b6c36b2c8e54869ec73781820df1410bbf32814cf5d9d3c655ed46d4d7
MD5 aa814b7952d3d08a26a5c0b02cee75d4
SHA1 568a9c283acac3f47846ea0ef9aefe064e65c1b6
SHA512 8b2983bf27cc7803b2f7628894ee06306d895f797fbffdd757a2bf6b93dc6035de3d32b99884a8ebb9289a15ef08bcf328b84764153f6a8855e812a849f72a62
SSDEEP 768:DuzPRnjUEtM3R/8ak+1Azi6f/uXSJkTHN7PELrx2Y1ODnQi6ZB2nnCjMiptXH5:eRUEtERDk+WVrJiHpPiraDAsCAwH5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Picuris/Innovations/Nationaliteterne/Splintres.div

SHA256 988c171769fdb17ee127e3207b08439905b328481110fc4e986c82b86a47cf17
MD5 d84d101d956dcaa912d18367b24eadcb
SHA1 9bc4b01d7536ee92775b0118e37eb0ad0763672c
SHA512 159f4cb662819cc9d8847e3bb7b583155a47f09c066be82c9485bd51f8111c66be44a4139a3ff784ccdef96938b051587c83baf0555676468e2be7b6f24c2e13
SSDEEP 1536:zinZwZXXUZPMxon+bnpOpVaI0rF6kDquIqYU7f8MhsdfKqSCg:zKG6PXn6pXZqDqvzcuCg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Picuris/Innovations/Nationaliteterne/gamest.txt

SHA256 f8e9889d60b90f3c00e7e83ef9eaa9773cd577b1da5f1c40849247b6582558f6
MD5 b89f823a8874799e8ea15005378a3110
SHA1 19803b07cac1c7c4df044ad171f29a5ddbe766e6
SHA512 15173f60bb09dcd6bc769d4b461786ee87680575ba157e6f2ce88258070a8072203e52e1c62db26300f761b0be62e23a8170dd9cac860e884a7ed3429f1b3cec
MD5 SHA1 SHA512

NSIS installer

installer

Picuris/Innovations/Nationaliteterne/metacoracoid.moo

SHA256 0d5232fb6b43acb41319bb8b40f35af0238674a3dfcc0f6162103ee8bb6425cf
MD5 82973e744b89081c186bda5efe6b4eef
SHA1 a736cedfc0a05c80a645e5c76b71288f211b2577
SHA512 7d4fb365be96663f3b3ac593a03f33e771232edb7d4380fd7faf99c6b588344121b53365fb83ff9699d0de60ab44d45a3f8609f49ba5009962b1772aa76eb2e9
SSDEEP 3072:4O8gTSSIADR7l7ppIJn/LPEjI2I6smechijGhh3JeTOEB9:4Or+WkFyKKhK9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ekstre.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Fatteevnernes/Lysbilledapparater/posekikkeris.blu

Holdouts90.Mis

Lovliggrelser/Sektionerer/Cupidon/Kobolt.Gla

Picuris/Innovations/Nationaliteterne/Splintres.div

Picuris/Innovations/Nationaliteterne/gamest.txt

Picuris/Innovations/Nationaliteterne/metacoracoid.moo

Sharing

General

Malware Config

Signatures

File Explorer

ekstre.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Fatteevnernes/Lysbilledapparater/posekikkeris.blu

Holdouts90.Mis

Lovliggrelser/Sektionerer/Cupidon/Kobolt.Gla

Picuris/Innovations/Nationaliteterne/Splintres.div

Picuris/Innovations/Nationaliteterne/gamest.txt

Picuris/Innovations/Nationaliteterne/metacoracoid.moo