240601_PO No[.]03[.]bat

resource
240601_PO No.03.bat
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

240601_PO No.03.bat

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 1ee6d9bece1b3e3dd1c01c6fc0248cbbe431ef637791292d1a6c8c4e871963ba
MD5 1a78687ea731375c8ac2e75231b0da70
SHA1 491fabbe3270c8f28e5af2c64260d71063cc9b0d
SHA512 27954930d79d752f67b42cf6a841c3b6379f082ec7a1f99aed451ddcbc72172b437de97a40a1a55b1ad16d421bda2591121b2fe161b5b9381a851aceb3a9bce1
SSDEEP 6144:87etGWJdW2tcM5Tnf2virED1JpAP7uu59po4PJL0L:GzWPfTf2vegbAP7uQ9+yc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nonacoustic.tom

SHA256 67f2e382c4c772e6957e1eaed2e9fc381f570e48782bfed7ddfca92470865a88
MD5 6b55319561e4b14fe2fb1e5d6b5f8d4c
SHA1 423e9dd94e91481063a5c74e44550438bca97d4e
SHA512 ef480ea57d2f4b430b4ff46cba6185fb0de37ef56b395a25c1474a2aab5bcca531a8b0bd7f636dba999cc8589316d26c550d43c3f33660025743ec8614dd2480
SSDEEP 3072:eoL+NHsfsi6mWGXvQZp3MjzVW5Tr8dnMUp3XDv:Vk3+Y2zFK0Tv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Trioses135.tre

SHA256 87ed3a0fb8d3d82cb931938db9bf9920d1cea9ee958adcb7aead546868f91127
MD5 76108c8fefb0274ec194bd8643a773dc
SHA1 2dbdde650f00474e84d83b0fd993c8d9e4ac4aa0
SHA512 0a7a6684d44169b2d2db8827dafd7d9290b718bc4c5346a469ed7542852a0baca0db36559cb93e3fc8fdc13d9ca5c8370a367f4328f95f21eb2dbb49878365aa
SSDEEP 96:nhKJwp3wE2nDqceasofvoWEPBCf2X7cnfoFHPOqoP+NMGGLv0xnRBCeGNya8q:4LFnOceasoXoWEI+rcEOL+BGLs7CeGNL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

adler.con

SHA256 85d16a9006347b8964417cc7d0350e1412414cb84e8f732ffec238134becb24e
MD5 b3e0a77176b5ba412279714bb38cc597
SHA1 768fb6dc5176772cf424f8585ca799dfbf6525c0
SHA512 00ec020bf19ea55200396bf6efd3fb2edf152e2029b4fdd813e1ffab6f70874c8ae5460ef4a80818628cb0e80c15299fac47107d06a491d07135e89ee745c24c
SSDEEP 96:pFP6KT82XJN0t8Y7Qt1W662X/kw3JJT7pfEU7QZOmgI8:pYCbJG8jncw33xp7QSI8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

bebump.txt

SHA256 7d2478b1e62985dccc79630fce0e90f4dba2c224a20be84ddfdb892aca95d358
MD5 0beec686cbe1058e076ffbaefdcaddee
SHA1 bcee9cc58811a3518223bdca4a27f4c15d1b7e8f
SHA512 bca04e9645a2377aae733983de03d7e4bbb571e08fd18055e04a4efb2d784bb65fde3695b22d227d86f1d2f8c43e087cb81866590e57b17544a196bded16f862
MD5 SHA1 SHA512

NSIS installer

installer

ethos.mic

SHA256 0d6ce3268159aea19bdc75c1ff1734f16e8d895a3bf0fa60fe844168e68fe327
MD5 20d85c25c0c9b1a3c57da87edad12ce4
SHA1 c58e0a87412194a5ca180418f7a03854368a6731
SHA512 a901fca810a21f5569427030267a10455c6d95b57a820016a12115e350cbf87d05e94e7c31ae09f531f99ee8555d808c5826195daf1c1abd38dd6ed8c89cb538
SSDEEP 384:z4zi6qESH76sQMBtRBOsd2Z1Ep4pMVT9hyG:szi6L0lQMBtX74ZeHVTN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ewes.ind

SHA256 744919d5bf95d091ae01d3421258db7b0d2980502b217e120c8a069e9100ff78
MD5 a945dcec68de1cc6bce2875a9c73a938
SHA1 805accb43fb937a62b6f2c4219beacef44b476aa
SHA512 61d89c5573f48d2681a454e0419b3fd4971510d42cf75c1696babf32a6208034fbcc92e7a46af344d389d06f455fb91f24c9eb296e936d0161f004dca370b591
SSDEEP 384:Y7R70KEu8X+nDdZ+h4IUPVvk6J8Cy78+u:wF0Ju+eVc6J8C6Y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

krydshenvisningernes.cec

SHA256 c3a773e40bbd3b776bee0c8e5ea32e5e215fb311ff25141e6185db7ab59baad0
MD5 3df66e463b3f37f9720bf915cdee1cd8
SHA1 89c364759fe356e1a244955163bc6a7257794a44
SHA512 aa57deac4a18528f3182aa7df6974daf2481dec9c9f65cd64843ac69ca641ec2cadc2d332589ddd988bc1a03b948bf441f801560af85f8bc5e6c8af246e6d545
SSDEEP 192:NLK5pAwHnJiYNFRyDW0s9YhOErMdmLa977bxrq7bfAWcjk:NupTRD9Yssfa9fpqfAWcI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

lab.kar

SHA256 5b6e382a525fca38c729487518220ed896c5893d2245bd79f1790c69e289bf80
MD5 cf64e5df927b48356f6178a492f0af02
SHA1 18d92cb30da165da44c69212dc58705c96c9b35c
SHA512 b66efa2c7625abbd7cb155f7c5dddc86393b506ccd5da27da88bc370e4ce7c8ae720d282cbfd46351de7bd31a47838fc9f40d62acee68c305011a944b281749c
MD5 SHA1 SHA512

NSIS installer

installer

leptera/Admirable/thaumaturgus.sky

SHA256 74569ca068303a339011acd9e003e47140c833368ffd74c6dba77616f25f7ac6
MD5 bd8fac6da408b0dd836e17d2741d6a98
SHA1 e2e14c6dba5f40b2901f04087e5762a57248f37f
SHA512 136d0d97be6cdfc9d43005f453927f9f155959ae79f777e841e3747dbf9a221145d24e985eaebeebadebb2a1dd83351842fdf493b801d0d61ad5aa2204db6fbd
SSDEEP 96:vtY/VgiFzw3FJkvi52v+NHwdBt98KsacfJYPZAkTo/R4opY0i:vtY/GOqFJkvi5HQgKspJYP5o/RxCx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

leptera/Admirable/tjenesteydelses.aar

SHA256 c45e3df64954ac18834736d612ae2c3dbfc60b84af5035254d410e456fcd5c41
MD5 bd46cafc141bfd6e7cb6cc60ecfa0f96
SHA1 1a9e3dfed18a3ad8376ae2a3961a3eb50860de15
SHA512 efb2e989486aa7c76d45d3e610b9b8ce8e6d0a5eb8c211fe54e5204bf44f9c7a722d7bb766a0dc8a49953c99ed826154f4f53a32ed0496d8c9e43e44ec2f35be
SSDEEP 192:20v5VQrQ8ZGh70yPKCfMNJgS+iNeP+rWyUYubRm95TVuYpaqVXUgp27tP:zvvAQrPKCENqiNeP+rxUYaSuXz1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

leptera/Admirable/udviklingsudgifters.utr

SHA256 d1ce12ab9b1f7cd4af1826fa1e7cf5b3d3e90c66b478ecf314c3450bae58146d
MD5 00c42b20046e61efe6e50b74620256b5
SHA1 4275e701e8cc63152a37e2ab58bc1c283734b90a
SHA512 183977d67b4176b978d05589ab5397905e132641d456dd5494a65d70f92d8303169ee6626ee28926dd32afc14d7e8f5fe1dee194d11b1e04d5e801adeee8b4fe
SSDEEP 384:Xv0eX8cTiX8y5ggZZvdhex+oWq2lHyDc4nMQPiP:Xv0c08KgWhrDIPM3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

leptera/modesagerne.wor

SHA256 6fe06f5f4888ebaef1bd704fd3e54dcd51c9ae52123b68ca9ce504d0236c177b
MD5 bfc28b3595b84813cc6d4643982cd089
SHA1 07ad5830d9f1a53421c6fb5438140bc2165cd1a6
SHA512 24253b8b1aca1ff3b234fc4517acb141d9f0f27b1c562debb59e966966891fd25ff919c1ea74c2e91f7142a551836a89d58039ee2584b1b58ac14b06fd03dd41
MD5 SHA1 SHA512

NSIS installer

installer

leptera/rage.zoo

SHA256 af5f6a97d63fe7e5abf6729d968f8f11fbd5d56d846b2a6772ed9f689641bade
MD5 c08e78d9879ec025ddb33b7a2b93b494
SHA1 6d639fc98d12e3630b537241aefc56dabb6f0ee6
SHA512 d81aec64667120442f422e28074aaaba50dc54eaaf469526ab501f64c5683b890e6a37b8c34f82d0212b3a91ffe88dbc53b04d7b6a745ed1b663d53e77d5a4a7
MD5 SHA1 SHA512

NSIS installer

installer

leptera/regionplanlovenes.unp

SHA256 ac42560ce3bb0862315163ab9e7ff67e81cc03d688b94dcfda1b0b49a2f068a5
MD5 657bddb75075c445208464d254bb8e09
SHA1 492e97da595b4c8349cbbae6ee9678923f29384e
SHA512 af5d3f9d31d28158ddc0c236a7f8416373a342ac8561b340b55cab588dad35e18c1440d35cc862cb3df2b0f0a70c6592daa7a6213d2fdeecd0f41b2e816051aa
SSDEEP 96:11E9H4Qew078GA20yzjZoHA9p8dJt6X1VeZUE87n9M:11EeQby8GmeCsq6eZ987n6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

leptera/ringeklokkes.lhe

SHA256 1520999b030cf976e168bb014ed194b0235671db56ca5fcfbf2fff70300d225a
MD5 b81b15583a307a78425b5c4ac265b02b
SHA1 280faebc9e1056a9ae67da245ebab261f6b17019
SHA512 737e2942ad77ffcb3c74042e197f49f69f0a1e4faf7c5c7e433db9a448443e6b29afcd7022a1b804d263eda848fc204d7719c7f2a900ca04f3888c5e6a3c2dce
SSDEEP 96:qwTY+mmToh5NX2ieSVtTnQngFqh0/J6P8rNJfwEQ4G8o/QY1Cc5QrL:PTFToh5NZFnAO2w0GJfwv4G8ZYMUQrL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

leptera/sidewipe.gal

SHA256 41a8f5f6ac9382e3c20b65b90e1db4b08ea92ab469ca10c9a0b7b438d53c5982
MD5 472b3bb4dc25385cf3ffa55712c02906
SHA1 4df99375e43d2153e6a6ca15fcc4220b3504d760
SHA512 0f903be15d2aebcb9407ae6e5b1013a1d98e921a6e27fff10a5e46aee2be088623f8470d92deaae65892ad54c3f269238d1a1cdc41f43e2404e2388411c93759
MD5 SHA1 SHA512

NSIS installer

installer

leptera/squeamish.dmo

SHA256 8d9a683dccca91ebf1f995ca46080def811aa801df0b54fcffcfe3e04f58a8b4
MD5 2a37fbe695a300da181db8364a773a6a
SHA1 fcdaa7656fa7e601ed519fddf57452c4c3be9f53
SHA512 fb3a51996a80c822209df83c3030248668e710cb63230857897e4c1c0a6e03f3d0ae4250a6a8073e5b86780d59f436ccf3d04efaa254585b11f431db9768dd92
SSDEEP 192:yZm6IwKTqMWk4ssdgcFVQyqYnOyVzEgZ4qj++6fJI1eec:vhnOMvCg2QyqY5OqExpec
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

240601_PO No.03.bat

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nonacoustic.tom

Trioses135.tre

adler.con

bebump.txt

ethos.mic

ewes.ind

krydshenvisningernes.cec

lab.kar

leptera/Admirable/thaumaturgus.sky

leptera/Admirable/tjenesteydelses.aar

leptera/Admirable/udviklingsudgifters.utr

leptera/modesagerne.wor

leptera/rage.zoo

leptera/regionplanlovenes.unp

leptera/ringeklokkes.lhe

leptera/sidewipe.gal

leptera/squeamish.dmo

Sharing

General

Malware Config

Signatures

File Explorer

240601_PO No.03.bat

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nonacoustic.tom

Trioses135.tre

adler.con

bebump.txt

ethos.mic

ewes.ind

krydshenvisningernes.cec

lab.kar

leptera/Admirable/thaumaturgus.sky

leptera/Admirable/tjenesteydelses.aar

leptera/Admirable/udviklingsudgifters.utr

leptera/modesagerne.wor

leptera/rage.zoo

leptera/regionplanlovenes.unp

leptera/ringeklokkes.lhe

leptera/sidewipe.gal

leptera/squeamish.dmo