rSWIFT[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

rSWIFT.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 74d6ad148e3cbc20e9ffdc0a98afb58d4ce813a30966b08d82cbc195535de1fe
MD5 c1c8248dbee8c637d345edcbfd7eaac0
SHA1 7d72dbe4f76da77b479301cb0488447771e7a1b6
SHA512 bb734d6c97eb0564857d389f8d5b94b2712fe37ca0e7667a7835583828efc8853f9aa0ac57cac77f42db7d294fe3f733622c66b124ba6b09aba167ca182a1988
SSDEEP 12288:daoOaTGw49hCTdN/uWBxouYft8pjs0pwvxM/r9RKGqHmIdD+e:copTx8CTtouCt2Y0eMz9RKHHF9R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

72:e4:f8:c2:f1:4a:52:d1:24:1f:aa:35:84:2e:8f:a8:42:e7:47:31:6d:bd:4a:79:6e:1c:39:7b:f7:38:f3:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tiltalers,OU=Krne precludes Skraaplanets\ ,O=Tiltalers,L=Corpus Christi,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c155275746562616164404f6c6f6c69757175692e496e

Chains

Jul 9, 2024

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Jernporcelnernes/Ationernes127.Res

SHA256 5475972ad409e49d2e9a1d539a9b244372330b3ae70a3014a8e7c084b2db037a
MD5 752523c837018c494691119f919dd9d8
SHA1 3b9d7b819616d694f018d367ab33678bc2664af9
SHA512 e35a39c7ab5dc2e761879aff8d3334713cc6ad01f5bb08db8d1e6cdfb2007119a2a36d10ea8eaff67b144604011f111a5d1f94096d84c8c40a7bfc137c8b9c90
SSDEEP 3072:UJ+tHyvpNsUAMYV7hkE2WfK9UonoqPjSaAjUJkBktuSDtGgA:UJ3vpNsXMYoE2WfK959+jjUGsuSsgA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/Herbiest116.vre

SHA256 53512f1c52eaf92a898fb36109dae0a9d213756a883e05b2f0fcf116eef6b60e
MD5 62de12ed6ed6ff40a198d8b60827cceb
SHA1 fdc628000b2c284c8ec7dd07a125060deb714813
SHA512 3941aeb05dabca894676c6701827f5e93eb262cf39086a445f9de4e26ad84727f5ada7054d35cc3b5b196ca7785c4e928e2328a064198eccd47841fb16364909
SSDEEP 768:Sx+0VL5OUfjWsP4iWQPZ1VJ0FVBBHvr/L2UJVQIH:SMRB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/Kendoist.Hyp

SHA256 2101fdd76c83913305ead90d17d6075980b70a4625b2abb926953ee55bd4139e
MD5 13a9207250d4d3f33bf5b4f676a35f60
SHA1 cfdd5c0ed0ce24407df35bcef83db5b63adbb27d
SHA512 5a482159435f8b289e69ebbbd726ddeccb2b6333c6a622279234119dc1a4a643e9c63411930257d545ab258e028218dcbb8076a63d051c4969d55c51e548d10c
SSDEEP 192:l7pmPjpf5L8cvxOCQ5ky208/v19KQAXkS+Dw/vJDC6smy6laYWEWD5xBZrPgYf:JpejphL8uktayFsfUkDDxVWlDWD5Rrdf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/Unfrail.nay

SHA256 af0e57677bd14876793edb39eff56c044919a1ab62cd4b16754f6745b52f22e4
MD5 2494532c59743970919b467911cf098c
SHA1 0a651c761229511408ec9974dae00bc051bdcb4b
SHA512 eabe10516f56fc95c24512e1d6ea0d6f9f28d353febf51531fa200479abe5a296da598f3187dce73c96949daec5aabb647ebddc4c7a75a71c56b2c627be9b894
SSDEEP 384:GlAaIvea1OoHvWR7RyDyrTF7TeFNXvCGEKutK3cAgnXE37WzaZ3IIDOGAOBp5qXu:0cTKRRvJgr6UWGKIDbzEUKf1gip9xvE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/afrettelsers.stj

SHA256 94e16d1fe3825dc4f2ca01698d2cdc0f1d4f9507aa606c7b5a6ce6d1e8bba64d
MD5 2c23f1adc70959d7f715ff1decaa3ffe
SHA1 89597d09d89bb076d30b3303feac287cecd339f8
SHA512 dbfeba6be17c9781049c9f3d4ac653e3f61b64fee143b47b313199d398bbc5e97c01506e9113ad0decba29db639e5dd2c0d143a50a13f6e1d577e359246eb3c0
SSDEEP 768:6tVRQvXsCZx/3WqeKzGl1ixDDcYhuMu39HqMjRCqaWW0knhjhPlKWMtO4G3VeEwJ:6P4Dba
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/figurally.txt

SHA256 66a293dc597f6dec3a665255a2adb2fc3652cefa4977e4551eae99f70586a94c
MD5 eb25616ae9dd1f3469be2ab4bc497047
SHA1 50b7c2992000772d52ce857e3ff4d30b891f8181
SHA512 8e4fb6f25baa50aa8e53a14d2443f48b01f0e6c8ee439bcd0b9cc17d8a799fc9bd9ba0fa69e5aa5784ad661457508f19fd149c1e8aaa44c5e53721c9f884b0e4
MD5 SHA1 SHA512

NSIS installer

installer

Jernporcelnernes/Blomsterhandlerne/smudses.yde

SHA256 5181b85f34ad4a096b83647c13d31656dcdd3c993fac3a96d4396b8d69f3e5e7
MD5 893cd3b016a43f89778f901eef7a7ece
SHA1 259ca8de763f1c32526bc23516f77130a7782faa
SHA512 31d393ae2e9ce2d155143ee2a5fe2493c6a5030f5c428ee29d8151d3315f27f13ab3dd7ff9a1dcc83c6d55cba64a13202a49a84000de22ee29300f3726a190a5
SSDEEP 768:TvBs/GHVGz2HBbnQ30Lo0yvDHGg3Gv2x1htjY8Z6nxv52ou+GwBCpEu8Q4IxbVIr:dsHOCa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Jernporcelnernes/Forbundsformndene237.gen

SHA256 889569c108fa11e997516be33f3fe3a596c51b7e724cc2685ff7489d1e4f785e
MD5 68e60fbc8995cf416a66817858cf474e
SHA1 11e403b2e4e55f3f273385e8a6b06e3af9df9393
SHA512 f63681e583c3dda89eeee00a064ed6eba46d17761ce4367570f28ed3311e07e7cee43264e1243cd800bd889855269bfe9cb65f7bd74e0eefecdee75d99225e6f
SSDEEP 768:7OnjCMOzGZmKApM2SXVd1FAWTowGv6AyC8ROl2MHLZnPvcWhXkSKUP48Y6jmZ2EE:ynwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rSWIFT.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Jernporcelnernes/Ationernes127.Res

Jernporcelnernes/Blomsterhandlerne/Herbiest116.vre

Jernporcelnernes/Blomsterhandlerne/Kendoist.Hyp

Jernporcelnernes/Blomsterhandlerne/Unfrail.nay

Jernporcelnernes/Blomsterhandlerne/afrettelsers.stj

Jernporcelnernes/Blomsterhandlerne/figurally.txt

Jernporcelnernes/Blomsterhandlerne/smudses.yde

Jernporcelnernes/Forbundsformndene237.gen

Sharing

General

Malware Config

Signatures

File Explorer

rSWIFT.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Jernporcelnernes/Ationernes127.Res

Jernporcelnernes/Blomsterhandlerne/Herbiest116.vre

Jernporcelnernes/Blomsterhandlerne/Kendoist.Hyp

Jernporcelnernes/Blomsterhandlerne/Unfrail.nay

Jernporcelnernes/Blomsterhandlerne/afrettelsers.stj

Jernporcelnernes/Blomsterhandlerne/figurally.txt

Jernporcelnernes/Blomsterhandlerne/smudses.yde

Jernporcelnernes/Forbundsformndene237.gen