86501b9b040efe6e4e14f4cc59f5a3de7f271a1843067c5f88b28732506e5871
- SHA256 86501b9b040efe6e4e14f4cc59f5a3de7f271a1843067c5f88b28732506e5871
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 86501b9b040efe6e4e14f4cc59f5a3de7f271a1843067c5f88b28732506e5871
- Size 228KB
- Sample240417-saqldaee7x
- SHA256 86501b9b040efe6e4e14f4cc59f5a3de7f271a1843067c5f88b28732506e5871
- MD5 fdd5e4a6cfb853cd2151cfc7da171204
- SHA1 4f9a2b364901bd1532d341e4fec81fe4e2b7e39a
- SHA512 5b22bcb559e9cc57475d767360fd3a99f80363ac08c67afdc033d0dfb133c7915d8545be405bce0f8c2b2ac934a3a4d351c01ef73df5d33186f8450e3658ff87
- SSDEEP 6144:M5miD9g8k7l+Z+RBxXDy1GHjo0PIx9Odj5:shql+ZEBxXDy1ujt49Odj5
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4.exe unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsExec.dll
File Explorer
-
86501b9b040efe6e4e14f4cc59f5a3de7f271a1843067c5f88b28732506e5871.zip 228KB
-
59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4.exe.exe 242KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Kolportager.Sol173KB
-
Lagothrix/Stofmngden/forlovelsesgavens.pos11KB
-
Lagothrix/Stofmngden/rekrutteringernes.kra3KB
-
Summendes159.Oft73KB
-
dyhrberg.txt550B
-
keratto/Minimwdr/Faultiness/Polytomous.met18KB
59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 59cfbef2d28f5f8df3c98d8525acf710bbad31e3bed87ccb6d8c3d9f5a9d8fe4
- MD5 4e4bc21a1c1a34037e44db52a50086d5
- SHA1 1419003d268ef43d3128c11f92e9533793b07320
- SHA512 2ee099ce340f23a535726a4310d0e40fabd23e3e4ded625fe4fc18ea2cda3c6346d28a14f91c73f01161d572e30090de124ca32e05265ce387dc737869db27a0
- SSDEEP 6144:jmGIhq8Q9AiAaK1Ga4my15stpehMPoCYRZ5oXuc81/L:qu8xpQm/abCMZcuc81T
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH d31c5eb927119d00232e4d4b0e32fcdb
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
MultiByteToWideChar
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyW
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessW
GetStartupInfoW
CreatePipe
GetProcAddress
lstrcpynW
DeleteFileW
lstrcmpiW
GetCurrentProcess
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
ExitProcess
GetCommandLineW
GlobalLock
GetVersion
lstrlenW
user32
SendMessageW
FindWindowExW
CharNextW
wsprintfW
CharPrevW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Kolportager.Sol
- SHA256 2db89a37308dd0bec38bcbb4ddc5f3958a7c060138be919e0f8ea0a576c7a307
- MD5 f6e4d99aa59cde583dd930370179e209
- SHA1 051aa95feadd6d0f9615f4a31b89140e56092700
- SHA512 54c77161068704c90f9da07e860abd059e5b670a8e21988faef0de6ee8b8ba7eca35093712b8027df367788870023b6285ce8dda18dbbbd2bf5c134b50f9f896
- SSDEEP 3072:+1DOOqXTmo1yKGxTrTMXccxay5wov4Ryg4D6/V0hwVvhoxZfy5ORP9:47MTmOyfMMcx157v4AD00uVgaa
- MD5 SHA1 SHA512 SSDEEP
Lagothrix/Stofmngden/forlovelsesgavens.pos
- SHA256 eb88750ab3290fc06d1aae93abac9f498a3ef795d7ad5808b5d4d5a0a1ad8b58
- MD5 c3793f132b6efa9e4e20eee530c6d14d
- SHA1 bff277d3d14f7fe48d0b75f6991d8ceb639097db
- SHA512 4d839aad13e4d92755d2aea1473fb203f166c1dc58480bf30329689f6bddd92b1f27f5858b0279b78decd685d2e0b5b913055db36b7ac5cee36dc8a2aeb47fbb
- SSDEEP 192:MBzSPPQtjysapow/mjzvGsh43iXF77q13DpeKuSx9E48cvIrTGdnC5w3PL3vL5Cy:MBWXYWL/KE+xeLl5Qrsz3vLV
- MD5 SHA1 SHA512 SSDEEP
Lagothrix/Stofmngden/rekrutteringernes.kra
- SHA256 ade0ad81a0f5d1714d4cf10c3bdf19e33830b2c109049efdda31902498a652a8
- MD5 25729204586f6be7c1d9cd6b319f3d78
- SHA1 27ea5a71123fa8f740f142784fc07f26f3e2f122
- SHA512 47f3f036555385d3e3c5adcb40c6a9fb4e6077e79d4d1795f317579941404d1499cb151641c220e0587704243a2feeb9a039b0b94ab6c7a24e03c21ea3b2ef49
- MD5 SHA1 SHA512
Summendes159.Oft
- SHA256 31c8811f89d1ed3880ae86e76b26967dacaf8fbd5a30f1bda7f21d69614891a0
- MD5 a03d86ecb21e749869ca040fa967e1d5
- SHA1 74a7b8524fd30616f2b7560a2f365601f360b8a7
- SHA512 750e5919d07d54f03045fe20030cf3bac8416b613fc439cd5a806d77c1b581bb126838c9a17d3351864a08c1c26ee5e0c35446bedea222cf6d5e4c92648e545b
- SSDEEP 1536:FMAlAvL+czWDQvPcCcdXarR1j8gVuEFZO3RN:FiDWqDj8WZI
- MD5 SHA1 SHA512 SSDEEP
dyhrberg.txt
- SHA256 5d77996969fcbd86bfc33dd02f196befdc496d6f55b2b6130505a45d82d93783
- MD5 726ec7edb2409230074c4948a7863d7a
- SHA1 23f330d97b36cd1bdff4d97cf411b068a6b04f3c
- SHA512 540a555d847dbdbc67550173694824b6d951d52302a79f2d0f120dda0d42f2c56c35fd02c207d0a8abdd6881252b7d9232fb2575b9ee9173b4187fd209f7bcfa
- MD5 SHA1 SHA512
keratto/Minimwdr/Faultiness/Polytomous.met
- SHA256 f4ee118336e84cd0c88567cc3cc27a7e197a0f1d0cac48fe038a95ffa6f3c076
- MD5 f6a51a81fcb420e5d6eed7caab294be5
- SHA1 bb1f3dfe3357793c7ac1ec61b855b802bd3db5a8
- SHA512 ab9b351f46cb07dec66d857e7821d00cca1b83ba64f6168ec0688eb1d72ee361d088d23f4e5527df622a415e575e7750fd1491712433f7126b01bc408a0c60a7
- SSDEEP 384:UexAMrkkZW+dHEHtq3noCxG/QjueOA+8hjstmdE9I0IFtaD4+DP/e:UexAMwQHNE03nosUQjdjhQtEEIVFtu4P
- MD5 SHA1 SHA512 SSDEEP