96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20[.]exe

resource
96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20
MD5 3241e9dc842b78c707935a1c82bbe906
SHA1 925707f0c8b49c65873e6677b1075b97df866719
SHA512 93e6084100e2b8302249926c5737054dd0c3675ec481a4099f9c8cdb76fa630aa192c8f4548b147d211fc0261d70e90b2e2f66b41f85d8183ac87eb3479e1a6c
SSDEEP 12288:f8oTmXIyx0DtKbV9Xaftvk6IAEy9UhK+8TAQ5+rROXP:EoTW0RPC6kyK104If
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Gunvors.Kle

SHA256 82ea42ad6898e041940173d172e0d383e4516b6f6574ede4a331d35cf20a62b7
MD5 9727692b0b13bd82cf4cb7af37fedcf9
SHA1 36a74d2abeeea323da0530d9210f1ed8332721f0
SHA512 caa619ce326046cfba1c4d6e56170f6fb6b48ff37ce0ee6b386aba52fab3d896daa8365874186ec03b088bd8c9997d0902437762d4d74c315bc1e100e44ed765
SSDEEP 3072:dLGg8ZtTHYLfbbJOn1JiGvz1r7Y0bbBO76ACtg79kmt8rI5Lmht1MRvrv4x+1:AgYEfbUn1Jl1Hrb866SiYzMRvrv31
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Ligydidae.mam

SHA256 59472058deeb4c40447d44502936e0362f84c130249ad97e359adb960d9e0dd7
MD5 d3f6868c0818103e2ecf2a34be561aeb
SHA1 603300772c2e961c6b8924dc737bc1d6e3aad159
SHA512 e388c4886f34a2d962ff153f14c6d2abb2cabceb6e48ddcaadb0586bd890933d70bd84c70f2634f7a7f9a038e6244b76e0343d849baabe380ecdfbb6b1ced6d6
SSDEEP 768:zBX1IOuKrOPRy82KI9huCuYCrQFsOxix64y8nTnHxsqqJWtFfhu2r6FqRYHsMvMn:dYjy8nWNmIv18yF2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mahdiship/laantagningen.sav

SHA256 5081bd8604e276fda7597c7535e34c5b8f3a136a1b3d4de4289b0ea20989784a
MD5 a9fff331f6abb942fc5c35e1c29e4be9
SHA1 a2df0ce91e27d4d8f483db82c0d7749e2fab819a
SHA512 deb8f9dbc391ca31ccfd7d4ba52bb9aa69a0ad7c2f2132217af0ce6697616c6e76cf29b98686c416d90a90b817afcf8c34d6cb5b1a550e94b4195da86c71e782
SSDEEP 768:277XUFU0mP7ZunWraygWVwW7xZPwhrzIFAD/C3mzYhNoGc4MNTopVke62XIlZk8Y:cAd/t+0oBIaW5cSc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Marxs.ano

SHA256 ce0784c072efc078117a326dda548f2031aa2481b16af9c85e8c555e95dbe085
MD5 b30e2818d30caf2de7668fbb9586382f
SHA1 d2398dbeb49bd4bd41e82e9779f13fcf136594ef
SHA512 674ac7f99bce1cc0da759cdefd515090f9a329199194de755ee4cf4f104db60082aafaadb0810d1c2b0d38343e37eeda091fcc446a613347b93423b90fde6fed
SSDEEP 768:lUFYHDGM+Ozg2yd8FfwMs++juZsLvKi5rQiYz0TPnDEFd1mg9HZaZUPmqmmLIsz1:lzdfEj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Smoos/exothecium.txt

SHA256 f04a389563c38da5da4ea895509f8755f78893ede1e4de8511fca96d5d0eedbd
MD5 f1caf21e82b7fb835823862a5f1eb5de
SHA1 8b7a89de09160a24bfbe09da1643d20519f39394
SHA512 aae771bfa9a488141a46935fb424151cb14d884013b7da8e28cec9ec6a30099e687bb7cf2bb1ef6e50b1fa06128763516e97bc5939ec0a9d81ef447e435046f1
MD5 SHA1 SHA512

NSIS installer

installer

96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gunvors.Kle

Ligydidae.mam

Mahdiship/laantagningen.sav

Marxs.ano

Smoos/exothecium.txt

Sharing

General

Malware Config

Signatures

File Explorer

96cf5dfbfad599910d48cf01f8cdc77ac3ab5f9e39e3f044bad94a28126c2f20.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Gunvors.Kle

Ligydidae.mam

Mahdiship/laantagningen.sav

Marxs.ano

Smoos/exothecium.txt