03062024_1537_30052024_PO # 4500078517.rar
- SHA256 7e0fd760671375007713c119e323441bca8d0d7ce5c0df2b4f5e24a8ad493c15
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fjasede41.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fjasede41.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 03062024_1537_30052024_PO # 4500078517.rar
- Size 621KB
- Sample240603-s2wayacc67
- SHA256 7e0fd760671375007713c119e323441bca8d0d7ce5c0df2b4f5e24a8ad493c15
- MD5 5fb0b73e70503e7aaa77c0f59c4a4931
- SHA1 d292528a4439ed148fe46c25e82ba75da2440613
- SHA512 015aa3645fcd007f8bcd9176cce405099e084842eaa832037a1426c5cba968b65b060fbcc480f7438be3cbac4eebf5721fd94ee03f1a80ed96897e486f9509d8
- SSDEEP 12288:veFxWgCCvO8Sux5OfKkE/wRFjWKX+uO9qNnhqCDQZlw75FaIUplqfv4DH/4BW+:mFxWKZOfKkE/wHBX+uO9ynhqCr75FaJ6
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Fjasede41.exe nsis_installer_1 static1/unpack001/Fjasede41.exe nsis_installer_2
File Explorer
-
03062024_1537_30052024_PO # 4500078517.rar.rar 621KB
-
Fjasede41.exe.exe 886KB
-
Bkkenbundsvelsers230/Hasse/overest.myn6KB
-
Bkkenbundsvelsers230/Hasse/skurenes.lit317KB
-
Bkkenbundsvelsers230/Hasse/snderrivningernes.dis377KB
-
Bkkenbundsvelsers230/Misrules12.tum175KB
-
Bkkenbundsvelsers230/Rapsens153.txt399B
-
Drolushness.Gyr66KB
-
Kommentatorers.tem414KB
Fjasede41.exe
- IMPHASH e160ef8e55bb9d162da4e266afd9eef3
- SHA256 875803c44c5c0bc99916ed140974c5666a10431c45b9a56e2e067ac46917cc24
- MD5 2cb15a1d330d94bbbfb9fe67e68eb2b6
- SHA1 d54b14b5546a919832ed4ec35ea4c7043e78dfac
- SHA512 a9d9b27c0b8045b8179eef63b9984b15ac518215bacc423bf8feee2ed2f01a38472c40ea9eeb0b09ab1ee1c5f975dd44d908b0a5ca29df8d6aa6975de06a338e
- SSDEEP 12288:hCl5E5tXiMobAWJXytwAhLLuYxxbELAEu73x4Vj+nQJzvdo4WmpWcPZjrde:hQ5DN0xtxNEkEuLGKQNLLde
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
b1:70:25:6a:12:b7:19:da:e4:82:cc:47:6e:12:07:21:7b:e7:24:6f:ad:88:40:43:5d:d9:f6:5d:23:12:3a:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Admiralty,OU=Dipsomaniacs Statice\ ,O=Admiralty,L=Guestling Thorn,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1741737369656e746f4050756e6b746572656465732e5265
Chains
Jun 3, 2024
Subject
CN=Admiralty,OU=Dipsomaniacs Statice\ ,O=Admiralty,L=Guestling Thorn,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1741737369656e746f4050756e6b746572656465732e5265
Serial Number
3a:cb:26:b8:b0:60:3a:da:93:df:05:a4:34:12:51:ea:fe:06:bf:ed
Issuer
CN=Admiralty,OU=Dipsomaniacs Statice\ ,O=Admiralty,L=Guestling Thorn,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1741737369656e746f4050756e6b746572656465732e5265
Timespan
Oct 27, 2023 - Oct 26, 2026
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Bkkenbundsvelsers230/Hasse/overest.myn
- SHA256 a1d91f70d2180dbc84a2fb4dd7491ba687bf148f8654082d160ff1a15b3ee49e
- MD5 34b08f88150bb48c1050f237f6082daa
- SHA1 316ab9cee783669fa9b429e8bfd46e4a897ed60c
- SHA512 dcac3449f6ad14b4173539cab93abe419fbfd84e351a4570b1ce45f7db3d0239eb457aa05e31608d4c828e234f11f37c1099e71e9e0a2baa0e1aaa4080edd50b
- SSDEEP 12:e8siCMR/R7m8OB8tlYGP7mFNuZFgNyu8W8yO8:e83CMRp7mrB8t/CqFgNydW2
- MD5 SHA1 SHA512 SSDEEP
Bkkenbundsvelsers230/Hasse/skurenes.lit
- SHA256 fdb7099c34056a0e631db151af19288ff8c1adfa1cbbd390dc5ea166de65dde8
- MD5 fc594652570d1c6012f91de33a3a00c7
- SHA1 0702e3a96ebe21f9eb42c2e375e24438d8f4487a
- SHA512 89aa3830bb764847f0416e93ca58d9b0882d163321e13260be637ecc055e5c09c40ac7b875f0f3de657c205ab92ce2519175a817b40a47c971df5d43345b44be
- SSDEEP 768:7RfttzjqPPG90MKy/54ipB0m6QKYXLKcbpm6jA:my/c
- MD5 SHA1 SHA512 SSDEEP
Bkkenbundsvelsers230/Hasse/snderrivningernes.dis
- SHA256 416dfb6eef4a9f3f49dc73f8135d4695d073697a1f685ea07ff7f3cf9984d783
- MD5 3d22b44cee5bd0a7e861faf2be4177da
- SHA1 c348dc3878e04299bd84855746f33e5b6b5e8ca5
- SHA512 32dd42faf97e9803561c7db40100835e8d683930f94216d66a4a9a4c2f5293522ca519733f2f28fdae16b6977d9bf7dbc09809e1e2e7761d87bd609ce8e41e3e
- SSDEEP 768:JchTekLktGSewpfKPuDdyrCGx433iSnUzYlRLGh6kjw3CEcQF:2o
- MD5 SHA1 SHA512 SSDEEP
Bkkenbundsvelsers230/Misrules12.tum
- SHA256 4d3dd20cdf028a2b3dc49ddb16c791f4b8f657dc71e149737f612ed8bb7f9985
- MD5 2eb6a94efce3c84bc9db02e04e76f8b8
- SHA1 0f3a8fe8115be4bf53e2a3520a07f05ec0c63390
- SHA512 3da933ba110e3aecbfbff301f3f174ef9d06f47445504316aaf76b04f4e982ab48c1f2e4cc3078ce324dfa7455edcfe28f7450a96c0a4a5f9b6ff8ca17f56a5c
- SSDEEP 384:ef5zSzDj2CINe2cToRHWSfJcY3zGmtdIHvF46jfi4j7P1Id2eS8xeiMZHcJafs8u:YSzmNm2bRcYMvtL1IEB8xcAV
- MD5 SHA1 SHA512 SSDEEP
Bkkenbundsvelsers230/Rapsens153.txt
- SHA256 2abc1683233a78bbc4117a451ba014a1f63883b0b42b526467a6b7d328400401
- MD5 833eb1c2a2f472342a5ea3bee5b39855
- SHA1 7338b5a670ad8198175e3d82f338619b37b8e0e5
- SHA512 b19d796190c888e22282e9d61b8dc665d4bc0474aa84c9fd7d9b28bcf391620c0b2b84fe28737e715fd5efa4000776ffa9d5632669bbab5d4bb226e1ab39ed00
- MD5 SHA1 SHA512
Drolushness.Gyr
- SHA256 450d3450c86ce89b8bd6b452db3cf1f91902de72373e78617c27cff7941a1594
- MD5 3f891976ec0266032f553d73e77f3ff7
- SHA1 1e13d52834c8774ae2496ae6e36103d9a1a352c1
- SHA512 dddf959786fe652bca539452943bc5360ef527155f8328fb783eca480e1d22661af104e26abb356fdfe971814c644878ef587a4479799588f737ed00bb834cf3
- SSDEEP 768:AXfKZzpanpfEEuOIp4lRih63FLduAboorUkpctvu2tsPo09F/GzpNHQMoySzgoEA:eMIICRiUxuAz61sgAF/GVNHQvgoW1t16
- MD5 SHA1 SHA512 SSDEEP
Kommentatorers.tem
- SHA256 7915e41c4b3b407f467a9c7f1f9ae128c213b8077aace9a82d43f70aec2bfa9d
- MD5 41da4d5b48252c862855c0dc45006249
- SHA1 bd01415c25cb64a1a247b729b4b747c44f83f909
- SHA512 d0503c54df7144dfa1b91733940a332953e9c4f8125e66c0157508cd6f354bcf12ea6d362a3346ec974650879efcfc772f6a0e33b3a2e07148faf12bc97829df
- SSDEEP 12288:37op92OYHjYEuyufbRNzvbDCy9JuLGlDMVtHrB3:37XxSfvvbDCy9ELGi7h
- MD5 SHA1 SHA512 SSDEEP