� MLr!<���`�k�ts+1�0�a:mO��V�~7��[��37�T���ǀi6�y���t_ ������1��@�%F���ߊ�ۍ2�X�R� ��ГB"�Hp$��0���$���koD����nb�����]�� �}���?��Cw�qSD���U�/�ɨ�Ƒ�?��� �QL��Շ��w�l�;�$'3|Ro�(2��x©Q��kZ ��|�?�G����ˬԇHᘂ���Af���>B3#��h��Kq��e�M�z�k� ���jy��������ec��;N� ��# 1����NE�$.X����� ��a��N�� ��5����e�h��q���6�.�֊�Ԉ1_�c2K���>���2V�;9$M&�8�Zh�� Ӑ���7(3����(;�|�[��i�sC�/)&����s�Zr�u�(M��f�8>�M��� fr�Q�ٳI�4��r�n�b�q:�)�y�X��[� ����a$��mhM�A9dž C��p���/B�o�-�7ٿy��7�p�Ƭ�2f�q+\' �F'a�&v䜯�4�B8t~YX��QN7 qQK�����`��Df���[�I���S���P/��X������ m{M�x��c��P�g��A>ش!�Yc�u��lz�$���~�G�N�I�Qx�vp�����E*Í���^���%r�;���'�Y�x�1�y��O����*��T�%�:7���.8L7���)��0�6�hWn&��k=Ե��wM>�y���ؾJBz��m����T�������hn���O7[:@WA ��,� �g}�\jɱp#�����W9#�D���Kiл3�����ô"3�V=��y��T���M,v�__��Q�)�M���e���vUMr�<Pe@�t^D�}k;���_S/���@�����xG��)��Z_4��w�@��d�=�ͯ��BV{L!@�-ل�*(`E���٥�D���Dqj��1h�m�Y���ǀ.2-��3�#�_�?����y�3�B���-a��a���w�P�,�Ⱥ.��� �"����Hb/P�V�y~f|*�S^�f�b2����}���5�p����DLijO�r�|��3ʅ2w�S_-�61+��rEA���P��\�;������V��V¦���_������?� �����T�la#aF��m���o�6d�:�U���r?�N)D.;�=�,�E����g.!(�� t�XҶ��s��z�W�Ғ��Io?��°�SY3_���,�/>)��>p�w���.�n]�2;��Z��XRl���`�� �|n,8U�ϟ��W�D�}�T�ZE�o����9�\b�O<+������"��h�� ��ۓL`}���Mì-��cG��G�6�3)R����B��W/R���83���B���h�*�7K?P�v�Z���ǚ��1�Zg���v��F]D8� >�� ����>yW��e���-�kZ&������t3�W��L�je6�TA��(T�����e��he��g�ܒՈE4����A��L���Qz�8�| �|�N���&-2�y����T�i�.�;�T�2��S'� 3ퟵj�Mn�K��Kp��dN'��c�St��J��c�?��F���"hxC˗����y�1���j��q 8��](ԏ��,e$��{�GI�T���'�3�N>�*���>�֟��Ý\�7f�j�������a���0˅k">����Q'R�)� �wz��~u����Sܪru~qTk^$�[����q)�X���ܐ�IA{m\���O���f3������^O-� ����N��a*��52�I�$��*%LUOYR+�"���/D������q;�ډ0q�(l�Ph��M_��}�����e0���\I3�;�ۀ���S�L�:20�xZ��Z��Z��Zm3?r�� ?�ln��H;6���V����tD>ָag|ɐ֍� ����W�S��Vt������䇠I��$H���v��֯��Y����^x�h����8LN W����S=�����;�U6�2��������o�fh�,�����qO.HC��Tꐻ5�Aqb1]��ہm��w�$�����7H~'��y��uK��fC�'��,{�������g,���oϑN���gt��RϹ���ͅ����wWk3�)��1-~�`� ��kS�UM�>�˟NPg6���g�����f� �}6����<�~�6x��;w�!t/��M�tj�i��V��CRV���:'�V�;�������2փA�W��� ^�#��3z����C�Odu��)`|�il� ��x������<V�x�*j�ˊ��Na��$�]$�H�+��/��.({� /4o..��_�|^���:Bpvu��kAc�}枤v�ɲ����A�J���G����o�`M/�����4��{Č���5l�L���v�Jp��lD,*;�L0�j���������w�X�m�������ܥ=s��7ۑ����{�7���:�$��!}� y������`�����$�=�%�^�Ҟ�Ld���<�G��Vء�x4��l�Ƴ��+�j̃_u�ˁ( ז�t�~�9M�a����3q˦�"��DV�N}m���AT� >U�+k�G-���h�QJ3��i��P�]L�� H~��{l���Xg,3�oT,W�m�.��m��$���E�[@z�}q�����gJHT�b�*5��5�.'��r1�K���R����3Wh:\(H�7u(��O�����ET6�O�5���N�b���N��e��ƞmp��Dh/ ���HCķx����ο~�����}����cp����[z����;�1�)3��K�.kV��g�O_;ԇd4bu\�Z��(kk�v�ۡ��?y�d�~T��8S���[�c���c:'�Ǭ�BrӪ�� "��/�Z��R6L�ĉ���!{��AF#;��e�X~��ܫ�dz7�m�3�N���%s�n�ڣ�ͧޙ7X�S�:�A��LeCm߷�b�EZȕjvoŨ�+O����Q�E:�<��c��Dl`'A�˄�����)��aB���6(�%��*���O�/57��ɶ�|��<���5��3�l�U����ނr���?`_����pR�)f�p�I�+����m�1l�N`!cl�:�{��{\ %+s�,��[>�qs�j�:�����.�RA��lؘ�9�p,?"���o���7*'��-p� �]{�;( �����yz�,��@�tP����G.kJ����>N��+�}�y�>��v���hI���g5s���r�&5tEGZo8)�k4T"��2P=�Oc7rV����a;���i[%��A>��ĥ3�@��&O'JqR�l�=�q!���o���DJd����QWi)���ʩڎ$�k�>J���L(�]�V��飪bE�]<ȁJ���U�=���2���ُp�d�(��i\OĜ3�)�P;5 � ��� v6�9|��� �<���}8�c���S���Y e*��{5fu�ؑ M!C1}�,���a��:Ƃޒ皸u��$s��%�A=�c��,}G,�6Iɜ��1�蟯��Q��, �eb�#�D�Ng�� ̶�]��^����mm3]+�9��7��������
Static task
static1
General
-
Target
Nado_MultiTool.exe
-
Size
6.5MB
-
MD5
e442352d6870d0a0a54a52df6072dd0c
-
SHA1
7ff5400d6ae2e46988bc34b0023918e7dafaf509
-
SHA256
ceb89c17dee95e5cd84f9d2d17829ee99bbe64c19316e23a2c712b437dbe3966
-
SHA512
53c81585ee16bdc2936afe71910d001fe40f927e032a0abee8412c5cebf3a62808d9806820cd9f7d7777f341b7b464173c352b334c1e9d7d2493410f1c799605
-
SSDEEP
196608:grCASUHWP3ny4a488g8i51eO3nBVJ/lhZICFNaHJ6VMGW:9ASUd4y8i5LnBVZlXIEkp6V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nado_MultiTool.exe
Files
-
Nado_MultiTool.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 516KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 83KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 31KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 177KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 21.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE