c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32[.]exe

resource
c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32
MD5 1799424409d5e0099fa315a0aa11b36a
SHA1 53007977e7eda1a6ab8cddfe2a7d882b8eb820b4
SHA512 3c37a3c61575425d5c8636bc81ea91c23e9ee4243d9517cdd70c78139c3f9a531b265ae87f0cdcb7ab2e81edcdbe10f273af042a507cfc021adadd75b9450b3c
SSDEEP 6144:Y7eCd6puQeCTGkiq0DYhgmZ0uPNrCSlbYnVannn/hygOdtUwj0TnmuqXdy:6PqGZSPNm+bYnVa/hygoRu6XU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Krapyls172.syg

SHA256 67cea0a0c921025e558737d5bb54ead4d0e795ad3d9688a87d18c3531c9a9a10
MD5 fe67cbdfc33e4bca1d5de148dfd4cca7
SHA1 601b7664814acea408aa7bbb121d5bb26301db57
SHA512 e3b9871379906b4acb92b71a67cd85bec1dc490cb710e39335a34dca7dc1dd9b05f80ac8a4201c6bcb115a76e3e439134745cb08d59f111f6fc44b6dcbfd06c7
SSDEEP 96:Z8NR23i27mHC6ldsqGicLJ4YmJjKMt6kG7MK/e4:ZuR23yCAcPajB6V7MKT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mattias.nap

SHA256 d1437c6d99ed6eef50164dc663df24df9e67783900a605b804efb3728eedcd69
MD5 c6878d37b9258f8af8406998e372374a
SHA1 0c98231f7395c3badd802af8b6f54759d042b778
SHA512 b291dfcf1eeb22c04edaf4b43ac1ae88b69ab1e4aed7aaa55efab1951b6f64bb395c8242874af449c036ad1a2c63cb0364943c03f096fa20f4a1b3c571a846dc
MD5 SHA1 SHA512

NSIS installer

installer

Monorhina/Slidsomt.bra

SHA256 7817a04e5ec98e43939698025a2133653f287290223320f237c12c1d3b6b126c
MD5 3c54b9521872a75b7ff9c08d5f58fc2c
SHA1 1c8a2a51e9a78b8e1f7e91b59a3aa4d9301095cb
SHA512 f121270d58f6f04bf57b6a86061ccacfaca783800a43da56ede010b22542df9553c237445c4e86e8d812f090d2255cd1b6540b87b25543b6bfe2dafaf413e0d3
SSDEEP 192:fpfdSEMUTMZjVLoPmnXD3/gCu1G5xa8sAiN4Ce:fNdSTUYz8Pm74Cgc48VtV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Monorhina/Vivies19/isocola.sol

SHA256 ea79b75bc89adb3faaff4c957afcd5ceee4a40b88f22bbed3b045c659517b9a5
MD5 1e5426fbae44458d0b5526b99d0958ca
SHA1 e0934e69b42abfdd6695ed678077725ecf0b5084
SHA512 c63cd9c148acbefb50f49b6168c0bd2d01d2a62629eca8dcdffd05a269d6092871d2ca7dfa86c3629453b8791e63f90c4a61cf6ef8e6f47194f39baf595a7b10
MD5 SHA1 SHA512

NSIS installer

installer

Monorhina/afkontrollere.urb

SHA256 9e0410ca591d013a22a483f132a6b42e66d799953f4b4450aa42b02015b93cfa
MD5 4f98614616b284cb3f6be2259a3baa26
SHA1 c750b5f26d0663189b089d2fe799f085e533b90c
SHA512 c5fb64f244d4a41d35aa00f5991004f03c621264885ed9e4748799f7b7e15a8c1ddd2bfd32a75cab8c350ace2ad7c3ceb2baef375e2b660e8927f9d863ca2e7b
SSDEEP 192:P15IKag1z48yfTvHm1GpudD2DrxwmUnagvnp4xzaM8QIbpU3NbiLghghkLm:NJX88yKQpuUa31fpfM8QHGgWv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Monorhina/afslres.ten

SHA256 37ad2dbd7f711971fd8ddd2bd78d5bdfeaacf52724ff9d7c7fc9b293f7c9b5fe
MD5 ed9e84934782d5fdc90ac9781dc9a6e1
SHA1 39dd2e37586c5cb5dd86a9f6a987c1fcdff45fff
SHA512 07fe7559008d6e528e8227bd64f305ba51eb739128067fca911485f02f5a07b4531b6b5cd3d32a2cf02114ca27e64e0b32fcc1d813b55fe2ea00f33d0843d598
MD5 SHA1 SHA512

NSIS installer

installer

Monorhina/discomposed.non

SHA256 02f91f9e1d345bd7daa518a98b5fd84b8dae146633a6a8f3b15c0586d8c074de
MD5 5fec97594ceb46a5c143053b0a9fa6e2
SHA1 8b9c1b04b41be3ae4e9d4909d873d7a3bc67272b
SHA512 a3832ebbb5db00c38fa4f60f9ba687499e4fca6f5c036e4b7bd3c1f1039c0425b7b8b82d834b00e39557f40748da5e725e6000c2a0bad0701b11bcedf96cf395
MD5 SHA1 SHA512

NSIS installer

installer

Monorhina/dred.jpg

SHA256 69881c64f796d9f2571116a8e6c3d9e1b77e6eb1a2cafe6c9a333e6ee486b842
MD5 18e048ba7596e10380f1ae242781b676
SHA1 aea8403bfc4b42addc05f6098d5ee56e8babc532
SHA512 e5599c1f77c9db3e027a2b38727f374e1746dd1281f42ac6397e478b9e4fcfc5a769ae8ea3f20333a409cbbce28ce1c7869b44336d7e4ee4d5f41609c6ee30fe
SSDEEP 384:wZVE8byaUmJ0B1YWBWiU+y/KnPXLeO/4NK05cT8SLs3afUXiH43j:wbrbz6HYWBWiZy/KnP49cTbfUXr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Monorhina/gametophoric.txt

SHA256 d4e94a18c627b29290276983b249d999f0f5df0233a2d8ce187dc7978d70aa18
MD5 052a3d0375e8eeb3a6a667abffc5f0ef
SHA1 761ca63ce01bae7bd014f1cbf299e3432604b8ae
SHA512 716b27e42775ac6a96bca6ace56d207362aeb8889db4dc10160a3f37d6c313e52f67eb70d8201b288b34caf0238fc332ab7db9297e42818fa7e963697eec0e43
MD5 SHA1 SHA512

NSIS installer

installer

Omkldningsrummet.Tho

SHA256 a876c3e03e8f18cfbcea26998d3823dd9e48e4de45bc98f613221c1cd1a27f40
MD5 3a44254a2629a44d84e98dbdf945ebac
SHA1 4683266fa876b73cca5142fc47cbf27e553d30e7
SHA512 1e133b6e75b3652f04b0cafb79cf4aa1d8cd1f88fe9002f623300a046537804e2b6d3bef71e14a5040ccbe914ccb02543f934cd138b5064d116ee7605f31d5a8
SSDEEP 384:k8CWLBaXzTohz6SrIfNZ6hn3jFo2Ysyl67Z/Ii:EWLBajTpWANZ6hn3jFlRZ/Ii
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sestertius.djv

SHA256 de842bb06394a7859d97c6188d1afa217f10784a1f564eb3e0140c94ffc90048
MD5 175c8e8cbba4fee420e7131defee9c57
SHA1 ed7ca0ac22608e41cebe91020026f4c7e30b5a42
SHA512 7b88a23a4b8d767a33987478b64f73ec8def254042f1c3a12f0120a85dc6e072dcf641709faa858aecd52425419fcd04b1d26ab06b18106ed436ddd7a93beae8
MD5 SHA1 SHA512

NSIS installer

installer

Udle/malningerne.bog

SHA256 d5443c561171fde4676c329f857ae86851bad9755348ec79b9b54cdb60555bbe
MD5 2ae1a3cdabc68b7f2aa156dc80a8ba6a
SHA1 e3065db21d4cd531e715cb46b300fac2a3ad2289
SHA512 03a1c5cd20a980a248acf0eead25e0e77227f70082622be4cb56b6f86fa3d366cb9567c4418ce2001a8534b57d77a27541f8c90be56de8c79e1762f4d1068bf2
SSDEEP 192:ftl1uywODc/D4zuFLp+h9JqgH01ZFDwMVyDdb8m7wzLqb8IpcypMHKc4nqAtpGn:f/YvqWDt898gU1ZFDwMIIr94G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udle/monodomous.kal

SHA256 2ee335fbd15e3e22cf0522bf4a7fa28e58c329e2b1691a01cd40dc4e18c7a4e3
MD5 29907025de7d88b9e24d525bcfcd0aca
SHA1 992446aae89264303d61432f16c934781a628eb1
SHA512 29215f48a2f67fce3b25ab7f6497a27dac1e97ea35847830706fc073558e51775371bc9fcfddfb760832e420fae8da2f106b2e62418db2004ec400fbbf067a2e
SSDEEP 192:nZFPnCY2Hm36vHT+Tm7rsMnTRmGJ/w79zdpwIf6S:7fCLHm36PT+Tm7gMTbxwxdpxz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udle/ornery.cem

SHA256 2db6d4fe9932e4d1f9a3fcf304fb869ea176385b5bb24df8fe1b64179d3a5f5e
MD5 2820c0e9196bfb3569d0957c4d310813
SHA1 44b546c5a75241decb0d419d509d86b0f83a228f
SHA512 57df8a0782035d14db6d29628ff210658a5395a31c614fb55ea1c93753fd9dcd07233bcd2264f8dc6522f90dce28a852d6a4eb6a690d8b8be11a11a22f9a9962
MD5 SHA1 SHA512

NSIS installer

installer

Udle/podagrist.ref

SHA256 f209716d597b246f27998da4749db45ad61a645de446e886463d18cb54dd187d
MD5 d1aa27be4695effde130c89ca7bfbc62
SHA1 32cf0d7b76a74a29b94e3f05858e0da7dfcc9f08
SHA512 aa635ddf1f0f9a0dd7812b341c67624d193aa1be7d0c2aa88ae64a2f51f1849323a3173ee6784d481bf91307fff55cf66ef6271fb8cdbd901ca3000a1faffb71
SSDEEP 192:lT1mzLGWI8BObOtq2V6JCGtsNigpgDjR1i8BxwYwu+p6:lTSI80bOgC6R7X+p6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udle/soliloquium.bor

SHA256 fdb32cc85c39d7fa95ff9634b7ab406f1959c6388a60f0ed7877ec1a492d6ee3
MD5 16af1a5579221f98f7a49f0a9e521704
SHA1 b9c4e48c381998605ea86dcd99c4f116bf2d2790
SHA512 4bf5749ffb3c367728610c3d9b8640e4a3663aacab47c898c5c5e7dcdab54c15e4368df4819f2467d9e22d6716860e4f0f6de12361f48bf8c1afed35f2136ed9
MD5 SHA1 SHA512

NSIS installer

installer

Udle/thoroughwort.ret

SHA256 02d407a9d84325c5a53d156ab1008a5a7daedbc6087c0bb21aed461976ee5eb6
MD5 a0eed22b474bbb911b0cbd28bdd4a543
SHA1 3810338add88f5ab3837aeb87ad0c8cd66c20aec
SHA512 ead609280edec21ae14b2514d2356b1b39fe3760b2419e63172eafa095db900069eb8d5fa36d6bebb7a81dd3796234794d90bc0ee742542c20ae18dee211036f
SSDEEP 384:A0BxOjCRAKa0HAMddbG798fJhmTu1US21:7S4PahS8SJpKSo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udle/torminal.wes

SHA256 dcada90e85ddf4b55afa174da586c17dbd970c76801a526fbbfc4c73c8619e17
MD5 f5fa64ba1796d441e9069d66eac986c9
SHA1 d1a07f8e72f9ddeab1cea5ae64068c92483f9237
SHA512 0bb8be2340b996061b92e7c004a301852208428961ffdcec6909872b21e3c68d3672cefc07231d6e05ed80a0395ca32381cf557043e76bbbd1da1c78020ab89e
MD5 SHA1 SHA512

NSIS installer

installer

Wisecracker.Mis

SHA256 daf138390cb10aabaabf990fe2b520d99719e5c09480bed244f104dc63bbc436
MD5 2371b106044c189f49b0219ed14cc73c
SHA1 9dd315a38f1e83a5c40c02ab29d4a1720153c085
SHA512 d38759435956f3caa546c3923b2a4235e68f3ac695f6e085fd8a9d50177965f604284e3cffc64787359a6f23f5bd807cb81f843d30aa22eb9baea768a06c14f8
SSDEEP 6144:5TaDHEEMMbG5cjUuTqZx8ZRXCY5vXn5Eqlk2gL1aFISJiQk4/hk1:oDvMsz49aCY5/6qldgL1a7pk1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Krapyls172.syg

Mattias.nap

Monorhina/Slidsomt.bra

Monorhina/Vivies19/isocola.sol

Monorhina/afkontrollere.urb

Monorhina/afslres.ten

Monorhina/discomposed.non

Monorhina/dred.jpg

Monorhina/gametophoric.txt

Omkldningsrummet.Tho

Sestertius.djv

Udle/malningerne.bog

Udle/monodomous.kal

Udle/ornery.cem

Udle/podagrist.ref

Udle/soliloquium.bor

Udle/thoroughwort.ret

Udle/torminal.wes

Wisecracker.Mis

Sharing

General

Malware Config

Signatures

File Explorer

c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Krapyls172.syg

Mattias.nap

Monorhina/Slidsomt.bra

Monorhina/Vivies19/isocola.sol

Monorhina/afkontrollere.urb

Monorhina/afslres.ten

Monorhina/discomposed.non

Monorhina/dred.jpg

Monorhina/gametophoric.txt

Omkldningsrummet.Tho

Sestertius.djv

Udle/malningerne.bog

Udle/monodomous.kal

Udle/ornery.cem

Udle/podagrist.ref

Udle/soliloquium.bor

Udle/thoroughwort.ret

Udle/torminal.wes

Wisecracker.Mis