83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7[.]exe

resource
83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7
MD5 a5d5a31f1cb8107cf72aefe172b1a3ac
SHA1 0b3ea3475d8892bcf07e2268c22455c684f0d06b
SHA512 723e05e115e6bcb5da04a0eb93710d8d53498443861e835adb6ed5f2ad94e7847862bd90dc9cba3886402f790f94a9c4cf194a9a2880999dd0f6739befb23208
SSDEEP 12288:/LkwkkHkkkDkkqkykkkkkkbkkkkkkkkkkkqkkfkPkgkkkkk9kkkk3ukkkk4khP0e:TkfkFB1BrY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Doline/Opstningsfilernes.unc

SHA256 d1ad2280dd0657bcb7cebbdb178501ec91a2b163a000bb2a2ecb4ae7b85995a9
MD5 907acab268d56f14c32779ce858341a1
SHA1 66f303b25521a3c78f532e25bb36f88ce00d7142
SHA512 2cbdf509336c1d47b91cd5fed2182900bf43f5571fde86c6693a04c3564441896cfd4b985467b67b2113d5d68e7dd403935c102fbbccff6af640d01393d24a8c
MD5 SHA1 SHA512

NSIS installer

installer

Doline/Scrupula.Chi

SHA256 957a1a07240a3e82a22bdf206cadd2b3300e9895abdd609e8412533846cbf19a
MD5 2d6c69927070674e46ebd3529b77eb1c
SHA1 8578352d7a70d19cb1798f3d9780d9cad9d03809
SHA512 eb36f63c6a3925c01bcf469f68d3bb2ef3b6f1ec397423840dc7983390a921b8583a674fbbcbf8e92a86e427e6e0ba15debf033ee72cc710329bf0c8e0932eef
SSDEEP 768:71Kvn5TCu7RJBY+sDTJlhRBeXLJDvl+/+NPLw0JL9xmjGNd6EEEU50Z4+jAJMkEj:71a9bBseJcoOsDgbMz6y9/RL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Doline/heath.txt

SHA256 dcec7589f3398f9f90edc9ba64290cc9cb3fb81077b9ce3a5252502876d598ed
MD5 83f0f0e43025995ca9de187b6d152f9e
SHA1 524000577c3d242ec3fc5cd35a2c65d4dda801ca
SHA512 a8a253cc62d2888fb7743eeea4ff4663e97aaf559bd8e834ccfe24d6302215dbb5e012dc849b52a9bebbf219e3e5b8ab373f3fa3df285c4c64c6b0f4188b86e1
MD5 SHA1 SHA512

NSIS installer

installer

Doline/sagnene.ove

SHA256 9c4a8b8d60f94453a75ef71c4aac0ee80a59f84285fd765ad0005c9ecb24e0a5
MD5 f8d340e2cd5f8b021b3260f7147da1a8
SHA1 d99bf860729a0517b0d0ad919550836a213153f2
SHA512 2e59488753fd2f77b83211557217db302052e6b316e442fa28b8390011dbe0f683feef37f81651236a69644c62155a6cfff2fadf40c5e7c33021fc9be4dd7b5d
MD5 SHA1 SHA512

NSIS installer

installer

Slapperne/Dybtstikkende.Kmp181

SHA256 828335e40b3bf2eae7cf9bd9e138515b3fd4b640573c1734084b59556c6e8643
MD5 10d6be284e4e5248a23f8046cbf5a9ae
SHA1 17860777753b6da4cb392fa3eb68c62c47026d40
SHA512 7ffca11c89196747346c92b52f0636b33a8a0db32faaed2b0b4a0cf2527865234d3c13a5433e093292054fb7109d1f19ead0511b904259d85c65e2947f3df0da
SSDEEP 3072:XW7S9d27UpXT+K2GZCszPmKRBj4W0ptb9aeR4Uoz/LVjeUbKyryIib/3W:V9d2Ypj+W3910ptEeR67LV6Ub5ZL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Doline/Opstningsfilernes.unc

Doline/Scrupula.Chi

Doline/heath.txt

Doline/sagnene.ove

Slapperne/Dybtstikkende.Kmp181

Sharing

General

Malware Config

Signatures

File Explorer

83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Doline/Opstningsfilernes.unc

Doline/Scrupula.Chi

Doline/heath.txt

Doline/sagnene.ove

Slapperne/Dybtstikkende.Kmp181