Resubmissions
25-07-2024 14:37
240725-rzbyvatfmn 1025-07-2024 14:37
240725-ry8lesxarg 1025-07-2024 14:37
240725-ry4mgaxarb 1025-07-2024 14:36
240725-ryx5paxaqd 1025-07-2024 14:36
240725-rytr9stfkj 1025-07-2024 14:36
240725-ryqqlstfjq 1025-07-2024 14:36
240725-rymc7axand 1025-07-2024 14:35
240725-rydfaaterk 10Static task
static1
Behavioral task
behavioral1
Sample
Nursultan 3.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
Nursultan 3.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Nursultan 3.0.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Nursultan 3.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Nursultan 3.0.exe
Resource
win11-20240709-en
General
-
Target
Nursultan 3.0.exe
-
Size
347KB
-
MD5
3500fc8f168c23e6170117e6b779ed52
-
SHA1
0109abb6ff102e3b8f17bfac07f599d787af8663
-
SHA256
ed2be8c7b8aa15f1e3bc399b9aaadbdbb16374e0be30d0200d4f39998f1f25a8
-
SHA512
3d1e2600f1e2b077ab24ed017dee2313f14b34a7c193d8db19a93bb3cc6cd95b620b50c2ab300e958afbeea1fa1d133758664282f60b97b583d748baf056e85f
-
SSDEEP
6144:igpFNojFilyzigCEcL6hl9he6VlWT8b9G3T8JUKvDbwmb0h6XW:T8Ri4h3hPVle84AWcIeXW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nursultan 3.0.exe
Files
-
Nursultan 3.0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 344KB - Virtual size: 343KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ