Static task
static1
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
NulsultanLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
NulsultanLoader.exe
Resource
win10v2004-20240426-en
General
-
Target
Новий Архив WinRAR (2).rar
-
Size
410KB
-
MD5
43e45267beb1bb0b807d69282e62bc14
-
SHA1
ac66d979c8cae9c5cb465fe2b00d177151622b04
-
SHA256
6323253c3728889a4929376833fdb1f7b26c206e6720cb0df7d48392f92edd5c
-
SHA512
79d320a40302ebaf16dd762bb59fc8c050689dc8412462a29018259e2f7aa4cbb145e8af98b88b9c5e8644174a4c5d8098ebc6ef47f80c9f00a443f392dcc7a5
-
SSDEEP
6144:9AcFEU3UiM+wGy0sCSzIKtD+RZKvlQigQxPzlbLd856Qf5cAZDk8O23:ScFZkxGg5zp8ZKW5CPh98566D9OO
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Client.exe unpack001/NulsultanLoader.exe
Files
-
Новий Архив WinRAR (2).rar.rar
Password: 123
-
Client.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 451KB - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NulsultanLoader.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 456KB - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ