Revised PI_2024[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Revised PI_2024.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 04aea1458bbe0debfdc6cbd993d9d3ebf52e5742cac8d5ad53a44ac2c8010d12
MD5 4318d52dc8b2ce92c02fe2683bb99a18
SHA1 18b9cb70831fce6941dbe8e3c23e6755ab873746
SHA512 5d3b5ea84e9b4ea0c1fd2060ac4b08b02bb2b76e8f9c6e75f7213642b97451f94ceb136540d7492c703e47ad7c8ea4b38f596d737f3ced79a119340766417078
SSDEEP 12288:PagXAeIT/4FGt8pjs0p0vxM/r9RKGqHmIdD+R:CgXAeWQFGt2Y0CMz9RKHHF9E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

29:48:4b:e2:20:82:06:21:0e:d9:75:26:7e:5c:1f:dc:41:c1:a6:2d:64:39:45:57:e8:e8:2d:ac:70:da:a7:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Aficionadas,OU=vigtigperen Overhngenes\ ,O=Aficionadas,L=Seneca,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c1468696d6c656e65734044696174657365722e4b6e

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Epizoarian/Anaesthetize/Herbiest116.vre

SHA256 53512f1c52eaf92a898fb36109dae0a9d213756a883e05b2f0fcf116eef6b60e
MD5 62de12ed6ed6ff40a198d8b60827cceb
SHA1 fdc628000b2c284c8ec7dd07a125060deb714813
SHA512 3941aeb05dabca894676c6701827f5e93eb262cf39086a445f9de4e26ad84727f5ada7054d35cc3b5b196ca7785c4e928e2328a064198eccd47841fb16364909
SSDEEP 768:Sx+0VL5OUfjWsP4iWQPZ1VJ0FVBBHvr/L2UJVQIH:SMRB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Epizoarian/Anaesthetize/Unfrail.nay

SHA256 af0e57677bd14876793edb39eff56c044919a1ab62cd4b16754f6745b52f22e4
MD5 2494532c59743970919b467911cf098c
SHA1 0a651c761229511408ec9974dae00bc051bdcb4b
SHA512 eabe10516f56fc95c24512e1d6ea0d6f9f28d353febf51531fa200479abe5a296da598f3187dce73c96949daec5aabb647ebddc4c7a75a71c56b2c627be9b894
SSDEEP 384:GlAaIvea1OoHvWR7RyDyrTF7TeFNXvCGEKutK3cAgnXE37WzaZ3IIDOGAOBp5qXu:0cTKRRvJgr6UWGKIDbzEUKf1gip9xvE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Epizoarian/Anaesthetize/afrettelsers.stj

SHA256 94e16d1fe3825dc4f2ca01698d2cdc0f1d4f9507aa606c7b5a6ce6d1e8bba64d
MD5 2c23f1adc70959d7f715ff1decaa3ffe
SHA1 89597d09d89bb076d30b3303feac287cecd339f8
SHA512 dbfeba6be17c9781049c9f3d4ac653e3f61b64fee143b47b313199d398bbc5e97c01506e9113ad0decba29db639e5dd2c0d143a50a13f6e1d577e359246eb3c0
SSDEEP 768:6tVRQvXsCZx/3WqeKzGl1ixDDcYhuMu39HqMjRCqaWW0knhjhPlKWMtO4G3VeEwJ:6P4Dba
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Epizoarian/Anaesthetize/figurally.txt

SHA256 66a293dc597f6dec3a665255a2adb2fc3652cefa4977e4551eae99f70586a94c
MD5 eb25616ae9dd1f3469be2ab4bc497047
SHA1 50b7c2992000772d52ce857e3ff4d30b891f8181
SHA512 8e4fb6f25baa50aa8e53a14d2443f48b01f0e6c8ee439bcd0b9cc17d8a799fc9bd9ba0fa69e5aa5784ad661457508f19fd149c1e8aaa44c5e53721c9f884b0e4
MD5 SHA1 SHA512

NSIS installer

installer

Epizoarian/Forbundsformndene237.gen

SHA256 889569c108fa11e997516be33f3fe3a596c51b7e724cc2685ff7489d1e4f785e
MD5 68e60fbc8995cf416a66817858cf474e
SHA1 11e403b2e4e55f3f273385e8a6b06e3af9df9393
SHA512 f63681e583c3dda89eeee00a064ed6eba46d17761ce4367570f28ed3311e07e7cee43264e1243cd800bd889855269bfe9cb65f7bd74e0eefecdee75d99225e6f
SSDEEP 768:7OnjCMOzGZmKApM2SXVd1FAWTowGv6AyC8ROl2MHLZnPvcWhXkSKUP48Y6jmZ2EE:ynwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Epizoarian/Skrmrullekommando.Pol

SHA256 4fb07d91f93055e11b24434a6ab521b1081ab7b93f0217646872a416b7661df6
MD5 af0aea1644a168adf29e1975a591cf10
SHA1 f495f9b558275309fb29e4018cefaebe2f7dfbe8
SHA512 cd6e4c92dceb27e20832d9e8e34160f47760a3460153c686e357f3a9027a2bfc89ddcc418d1b67c4382095716b16ece6ae5a735e68fddd18ae82c190f7857daa
SSDEEP 192:LYtGzWvNqoDOIXKBf+CsW5K4mk9TIh/mtn6aXZyDI6VguMyaP4:sIz1WXKB+CsW5K7k9m/mtpMFcyaA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fuldtalligt/smudses.yde

SHA256 5181b85f34ad4a096b83647c13d31656dcdd3c993fac3a96d4396b8d69f3e5e7
MD5 893cd3b016a43f89778f901eef7a7ece
SHA1 259ca8de763f1c32526bc23516f77130a7782faa
SHA512 31d393ae2e9ce2d155143ee2a5fe2493c6a5030f5c428ee29d8151d3315f27f13ab3dd7ff9a1dcc83c6d55cba64a13202a49a84000de22ee29300f3726a190a5
SSDEEP 768:TvBs/GHVGz2HBbnQ30Lo0yvDHGg3Gv2x1htjY8Z6nxv52ou+GwBCpEu8Q4IxbVIr:dsHOCa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rbdiges98.Ton192

SHA256 c6a13a97446366a1939a44ac4a39e9ee5fd658dde536ce4670c052c21670bd99
MD5 9ece0a8f081af5c788218b2d6105edc3
SHA1 c75a1644271b152a3ac45d1fab1351a2d3d94989
SHA512 cddff84fe57f056493c0d312faa39eac764e602ca961e0678f3b93724345ff8b7e7a25391f2974ca40f31cb6b5973b889f45147c154e0fc119460dd20613f303
SSDEEP 3072:FI+lmmanXvisamtCPMt8F7nP920mMKjs/G9x2UvFp4y:mggvLCe8hAPtw/+gyqy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Revised PI_2024.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Epizoarian/Anaesthetize/Herbiest116.vre

Epizoarian/Anaesthetize/Unfrail.nay

Epizoarian/Anaesthetize/afrettelsers.stj

Epizoarian/Anaesthetize/figurally.txt

Epizoarian/Forbundsformndene237.gen

Epizoarian/Skrmrullekommando.Pol

Fuldtalligt/smudses.yde

Rbdiges98.Ton192

Sharing

General

Malware Config

Signatures

File Explorer

Revised PI_2024.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Epizoarian/Anaesthetize/Herbiest116.vre

Epizoarian/Anaesthetize/Unfrail.nay

Epizoarian/Anaesthetize/afrettelsers.stj

Epizoarian/Anaesthetize/figurally.txt

Epizoarian/Forbundsformndene237.gen

Epizoarian/Skrmrullekommando.Pol

Fuldtalligt/smudses.yde

Rbdiges98.Ton192