86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6[.]exe

resource
86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

IMPHASH f10e4da994053bf80c20cee985b32e29
SHA256 86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6
MD5 5670f42a9ed9c593b72fdf7351cd5e6c
SHA1 781615f55566cd8f5442b6bf7e065ab7cea1b902
SHA512 ace933955f63a7f7a0fd873907992371f6f36304b78bf12fe47f7046162f97a6b0cae082e1c354d9ada1ad6e631f1fcc1b26ad44e987a8a334f6b37e8e5d3f38
SSDEEP 6144:cM231sHcuulI7ph/+nA3feUHzXclMIXuLQwidBSGYFuXSjLat:UecuuAph/IAFzXhdLspY/U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton SetWindowPos SetCursor GetSysColor SetClassLongA GetWindowLongA IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersionExA GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
MD5 e23600029d1b09bdb1d422fb4e46f5a6
SHA1 5d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA512 c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
SSDEEP 192:Vm9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Chowchow.Omt233

SHA256 ce767eed48806dce4a8cac8278b71e317d0d1e1246f6b27a3c0027b3eb5e5cdc
MD5 14e2faebfe3f57ed6df78d93eb134f59
SHA1 4b73bbe29d60a0f61954575bd0162833739da678
SHA512 4b32ff104e402f18cc10866076cd3f63b782bd76423790b0ee9f3101652b9d8b1d61e328c7b30ebfb6fa1e5b35b57747c3e4366089e196ce1059a252f138a7e2
SSDEEP 3072:BThYKXKVo2d11AylnFfNgTMccaIE20szjqF+rcl9ef0hbZpNR0Z:xAV/SIFgIcb20szu++9Tlg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Demiman/skismatikeren.emb

SHA256 6273941a41c65821bf9cff0b3caffc43a7cbd259ba408eb637299a3782352dbb
MD5 e2c0a02b1baa35740e2636c426f689e9
SHA1 f1436754b87c4c9dcc4f4218c1cdf86dec33f10a
SHA512 beda4eb65abc4bcc8d5f8ec247addcba9db5f20fdc76714e9f259752bc77bfc03eec546a4d361edfb3cdcb67c0e090bd118201cc2c58ec9e10a8e089bf50d6a4
SSDEEP 96:TLlF48SwDoajqg030z9F8pOmWIaO71X/bB1NeRxIXSIsgwumn9blfTN:dF4JwEP7kz2OmWIj71DBZZwz9lfTN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Demiman/sporskifterne.nab

SHA256 12ca6408a66fc7aa95e5350ae19327a3b33b1b87659cd5ea766a3a8d3b816fe1
MD5 df4e5fc8d1df7776b166baa0634c6f9b
SHA1 bcd5faf6b1c1243e75b13959caee021ad6999645
SHA512 5783235fd19753e38adf7d9e1fd88ff1a31c26b1a5c3a7d16fb7e04e32ea090d8d702f5719518de928af2382ad927c6396b7250f3970c818a97ff7f28be18294
MD5 SHA1 SHA512

NSIS installer

installer

Demiman/undertallet.hex

SHA256 9ab57d70846247ca999c5ee09675bb2203399138120098d86f807d08e172f96f
MD5 f73c812ce87a8fd9e97e78cc7da52186
SHA1 f67cb0e243bb8f1c8812a6ffb538fec9e4a98181
SHA512 93ec77eb3ec747d6c485c9cb462ca8f5951500507216865eb3ccafc57e49a3f9bd2c869b97c49596dcceed31f90c2627a1ab78d63d8aaba773b0caac3bbff953
MD5 SHA1 SHA512

NSIS installer

installer

Opinably.not

SHA256 83470f4b863e660e89be42762270150ef654384f19ecac58e762f5e78e2f023d
MD5 9775d6c124aec3d598a1c5936d12a0ca
SHA1 86a0062f137e195a8ea8e85f93359efa9b0cedae
SHA512 f8fca45ebc4cefafbfe79315e0ea2fc6a5ae3d1ae959c1c853d89b885e57acd364c71183d2e7a5ce4eeb0081218a97df9283114514f85843c6fb5c287c8de034
MD5 SHA1 SHA512

NSIS installer

installer

Stabilizator/vucoms.exh

SHA256 6475d5e53cf10b4e9c9a81068893dea9d0173ff500c34b874ee7f7b55f218a8d
MD5 ebc449df8daac6d2290e846bd61b0fd0
SHA1 d2e000009afa4e26257d4fa5393f814b63543389
SHA512 1ed406a9ab2a0f39221ec8b43c0458e59eb0e6911b57538b67dc7fa57a218e42ba70fff1297786875293c734dca7a31d6c4004eb26523fae8b61bdba67be53cf
MD5 SHA1 SHA512

NSIS installer

installer

Stabilizator/xylografens.int

SHA256 ca570f7aa09f217664f26fa339afd44ffd03eb2956d99b847403a4962557e463
MD5 0dd8c522e295f8bd1a3efb535911a87b
SHA1 a85867621e27e2bfe298d9d670046cdfec8fdbcf
SHA512 3d0bbd543235e38718b93422620a3e49202b04315cc0fbe43d98a98d2b8ee65d0647415b1555e3b63783a7b2e85ffd14bf3f363e40cc04a4f683bdeacec1979f
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Slugterne/Nonbarbaric/hello.for

SHA256 e095e7e9ce3eed38237916f014aea177f74fb01ed8b6bcad0a85af2793ac04a8
MD5 69d74868421884d2c076d5c5c6d61e96
SHA1 f6d34661b96b3a2d53e30b2b4ab10fb311b4132c
SHA512 6c01824ba937e5e7c1915ca0bafdb595c80e84c45ca6e5c7002a34075316a8abb799dc72a46185506df9de653aa8baf23d1f88ae275b84d4b485c321c43242e3
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Slugterne/Nonbarbaric/jargonal.erk

SHA256 1886f1547665ab680ccb272819191f4afec620519b5e25f0eea0251f8d710122
MD5 f5099e71d0dbfcb9bcce872194cd6fe9
SHA1 7571488724898f13fbf3cc268678cd21fe46c167
SHA512 8a1d397e6561d10206cab3b9e912ba15477e3be6473d4c96f647c89158878174c750d802ae97be74b7b4efaa4140042a8c0fdc7ddb3810c684147e2589101c97
SSDEEP 96:hsods78Gb0iKx5uyMCGSoNXs2/FUY5Jkxh4k+1f1+e/gR/:9uJ0io5uyL1oNXs2dZMh4r+NR/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Streungen/Slugterne/Nonbarbaric/nrre.dad

SHA256 401cd049f00c3944472986f215cb6b32cb8f5140b5a9f6127251b5683e950466
MD5 ca2ccd1ea1e6f8eeca1b515f01441360
SHA1 fbdc0920dd76043abc9dab4f8d8ed6275d0d32a8
SHA512 604a86c8a65326f7edadf6f819b37dafe6ee40fdc03843331a27b546c5e3d844d0230491c6856c48c206616fba2adceab44e8d15b512580c8882980603a5d614
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Slugterne/Nonbarbaric/pennae.bag

SHA256 2ed9b86950df0a3c194736069724210ae746d331a7ef143ead1a5b13c04f5e10
MD5 d16950e0a957363d6a1e0661d84ddfbd
SHA1 0f258d8807f0f9d7354a43ca86e330ef3c8a7cfd
SHA512 1f46c59b2eec19a855d1fa84cdbf9851ff972c503e1608347d1fbb338f82a260dbbc21b5dba68253a4a32f48842f68fdace794273ee9c6681badfa99a8bbe612
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Slugterne/Nonbarbaric/repraising.tel

SHA256 5207c98b3fad879fd4564432aef2690e7c156088469ce92e92687a226c73c14b
MD5 2596186f03ec2971f4348da570adaf7e
SHA1 790e6882a90d3872c3db85dcee96ce9ff950944c
SHA512 8c267239c6f7de83df78fdb3efb12e7790ebd9dce445b9d4bafda9162a93bedc342c62e885dcc7090fe5e1498644150d624b9ba730754d2f681ec0c09bd6e6c6
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Slugterne/goosish.lim

SHA256 08765b3126f6d221444588c359da60fdfc7ca61c9ba309ae00a15666b41e2d64
MD5 15a5f7b65724d250eddb1970fb430956
SHA1 d937150a796e043661c5e7cdeb8c6434e6c911a7
SHA512 da7cd8c9848f0aa0afbb0f3ed1747ecd4a9dfe83908c14a71cdea4575c381b8f0fd335b63909f8388c17ff0073db1f463de6cb498a1c611026cdb62d974cbb42
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/Stofmisbrugene.Bot

SHA256 aa7f923dfb57eae80b2d45d6770aafccb37e70c01c09386a9dd5ed8c47264894
MD5 2b4227dd99f94a482cf34a4b595349ba
SHA1 54797123ac7d317aa96b49bbf8b945907d8960e2
SHA512 e6c575b2bc4c5f2d89df253e37f879d33daa89fe217091e9aaf73f0bcaa9328c6ceabe5de308beefe790acc8bc3ad4bdeb41ace9d0c2988a5ea14786d0a2c0d5
SSDEEP 384:iIKhDAwuhVQ0C/ZlLlxgQnglEnCVM0JDFqnWA7usk:ifawPz/jLlzuL5EnNusk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Streungen/Unacrimoniously.blr

SHA256 ec986bf3ed2d625fad69c05185ac9be17f35f946f8cdbbb0ccc591445a5d7617
MD5 165df26e2a2b68d155634b094231ed08
SHA1 f676e662110168a17c505a2697dbbd296a201bfe
SHA512 a158c686910bc6990ceb85a7a7f84befeaf681fc330f066ac0cb4dcc54e7267cfd8aa3bad64dbe3a4c020e15b060ea0405fe351688c22f3bd36df4d5f6a1ad3f
MD5 SHA1 SHA512

NSIS installer

installer

Streungen/dom.txt

SHA256 39c6b425678b6914155dec6f5e45847b8d78ce0108f8d94cee97e9638f2c36fe
MD5 f0524c490855b36d5e9b86cf2b5662cf
SHA1 bdaa782d8d85a874410995b5d8a5441bdb8064c0
SHA512 c7869958d22cf6fc1c615ded01ab7cd41cbdd079546c38d31654db6b459e001ab183e267ef1d48dd74994b53eca97a98f1e2d5260269559df17f0a6af3142a26
MD5 SHA1 SHA512

NSIS installer

installer

86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chowchow.Omt233

Demiman/skismatikeren.emb

Demiman/sporskifterne.nab

Demiman/undertallet.hex

Opinably.not

Stabilizator/vucoms.exh

Stabilizator/xylografens.int

Streungen/Slugterne/Nonbarbaric/hello.for

Streungen/Slugterne/Nonbarbaric/jargonal.erk

Streungen/Slugterne/Nonbarbaric/nrre.dad

Streungen/Slugterne/Nonbarbaric/pennae.bag

Streungen/Slugterne/Nonbarbaric/repraising.tel

Streungen/Slugterne/goosish.lim

Streungen/Stofmisbrugene.Bot

Streungen/Unacrimoniously.blr

Streungen/dom.txt

Sharing

General

Malware Config

Signatures

File Explorer

86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Chowchow.Omt233

Demiman/skismatikeren.emb

Demiman/sporskifterne.nab

Demiman/undertallet.hex

Opinably.not

Stabilizator/vucoms.exh

Stabilizator/xylografens.int

Streungen/Slugterne/Nonbarbaric/hello.for

Streungen/Slugterne/Nonbarbaric/jargonal.erk

Streungen/Slugterne/Nonbarbaric/nrre.dad

Streungen/Slugterne/Nonbarbaric/pennae.bag

Streungen/Slugterne/Nonbarbaric/repraising.tel

Streungen/Slugterne/goosish.lim

Streungen/Stofmisbrugene.Bot

Streungen/Unacrimoniously.blr

Streungen/dom.txt