Payment Copied[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Payment Copied.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 af21f23486e8b09304a6d8c72dc0573de026669d99824d5bb9936ce420d971a9
MD5 715ec7286e29209c9d739994bbebdb38
SHA1 b7575e55d7508711cc92534f479628df66f3bebc
SHA512 a93fd626e5b051cab2418b2046f8025c32aa3276b21be19c64c3817be6ac2d8ddd84303dde3552710b1cdd07b65196f83313a4bddf5f5a7ddbcc2b8abd9d4d88
SSDEEP 6144:hPX4d/3rN4XTDBZ0tHHOwTd4Dvw+d9MXYKvTmYj3rTqT3SlABQ7aYqewB:iWXTFZAnhTd4vL+VviyyT3nY/Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7d:b4:8a:c4:77:14:5a:16:7a:ee:0b:15:6c:d5:d7:37:48:c4:81:fb:d3:7d:b9:81:12:39:6c:a8:6e:7d:e5:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Neurosclerosis,OU=Hyperesthete Unrepentantness Deputationers\ ,O=Neurosclerosis,L=Litlington,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1d507265636f6d6d697474696e674041726b69766572656e64652e4c6576

Chains

Mar 4, 2024

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anmasse.fib

SHA256 25ae5fe5f982bdd48aad9accfab34d2211ee86b206f6eb5004b73584ec8f3f35
MD5 de6a92efbf26f2eb011ef2b3a46ef200
SHA1 0a3addd8d6d5fb18051f459af118653c3103beb0
SHA512 7da881a8cd2439e3a2a70baac66207066e49118599c42cc3b5e287512aa9a232710d865cfa38ad830c99d4a397d75621430560ee4e1ac2e4a142363d4b96846c
SSDEEP 1536:DjBLic/G6mEFYyJyieCSNgzZwI7249OfmR1p9r67i:5iRJ+Xe1aZw4TOOvpd6+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cotyloid/Bldgringsmidlet/Adversion.txt

SHA256 c5c31ee21f59f68d78a427f891bdfd80fcc42d0961e396e9ff9f9b2886ed543b
MD5 2b3fa5452bebd73d4174a16f2ebe6f8b
SHA1 19002671f80454ceaf91c3e2e76e82791c449f0d
SHA512 23f8bdc4c82c367ba8c4386d27b705574594ee801b9bbeed8ca1d75f2b17863ad73e37f0fda6a9be674c37e06f8f74ccdfd48b3c9dbbed51802d80220abdd266
MD5 SHA1 SHA512

NSIS installer

installer

Cotyloid/Bldgringsmidlet/Extraequilibrium.Sus

SHA256 49b08fc2d8fe67091db8b9570cd2b13148386716e35ffd0fbb7ec1d606e52bb9
MD5 91f38ab796363c9416fdeed3872cb354
SHA1 c5623edaddbc7e4871e12e6c80a2daead455ade4
SHA512 6e1714ce6be45263f61c8b0bf67bef27f95f9a82c6b22f6171d3ce73fc9f6308d9a9eb40570c203bc2571141019363e40993b8f0edc6c41baeae18392d7161a2
SSDEEP 3072:TQweBOLkLluRuOCm3Kp5tf+TiT7B5L2aOkpUgOEYkEdkbS2MSb:072k5Gu63KpP+T8V5bUgUkNM6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Knebre2.Une

SHA256 6a59759b26df95a18e11ad5b1899d78ebb5a7a6d0633a87c2c4a3d4b11c1fbdf
MD5 3167c81cadfb70cd4dadec07a99f7f60
SHA1 b8ed8843d107a016f652fd79d996a67a83409dc0
SHA512 abef75b2ee6e459b9f140570a3b1966151e58c81472e9c2cceb6bb9f04bca1b87415c478c12362aba003b4c2155f359e35185a47ab82adfcf456288d4e816e7a
SSDEEP 1536:NiVbNczKKQKpqNq00dEVw5ADK1KHPRmvDH+SV4RYJrP0snoOJWo:INc3QNNPC2u1W522RG0soOt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Popularisatorerne.hip

SHA256 f4d88f6a0067f129be83b8fe5978fbe71dd10ae7666aa149758684ea12833f8b
MD5 d3023ed0dcf1a4c15f1fe171d5386999
SHA1 c22a9ba06aee31439bec8e6f721c78210f84564f
SHA512 ccd0ce120619fc76db318147a3ae3d1d70aa79fbc416a7fd1c6eae9cc90069c2abfea78687a733bb1c1b5ee5e68a4f670c269f3df87450b93b4519c2e2b08f59
MD5 SHA1 SHA512

NSIS installer

installer

smilerynkerne.orl

SHA256 3dbc0d8b4f72ab04b8cdadccff0cf19a892871d5a9d1e4957584e52a4ed541df
MD5 a543b6141b1c443dc88c70a7f71180b7
SHA1 8f4816a2b7ee5602f49284029ba676e42c5c2a5f
SHA512 bfca30231d64b6a35d29503e06eb2f2baf92397be3a9931e50b2746364adef564aea14b24402355cc889d95c12cc95b42b419f62e1a27a00bf382578ab26b506
SSDEEP 1536:yvlMoAhguEkzOmghJ0Kd8eP8zANlDVwvmHG3p1ogaE9WuTE8odw9h:OYhZEPLCPUNdamHG3p1MiTEJGh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Payment Copied.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anmasse.fib

Cotyloid/Bldgringsmidlet/Adversion.txt

Cotyloid/Bldgringsmidlet/Extraequilibrium.Sus

Knebre2.Une

Popularisatorerne.hip

smilerynkerne.orl

Sharing

General

Malware Config

Signatures

File Explorer

Payment Copied.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Anmasse.fib

Cotyloid/Bldgringsmidlet/Adversion.txt

Cotyloid/Bldgringsmidlet/Extraequilibrium.Sus

Knebre2.Une

Popularisatorerne.hip

smilerynkerne.orl