General

  • Target

    Setup.exe

  • Size

    278.4MB

  • MD5

    9dacbadf533162eee3232c6145379ad9

  • SHA1

    9829f28df6665d9151bbb220859793195b22eea9

  • SHA256

    7d16afe9c55f554a56e3e5475b7232aedfba3aff39ebb8f4000742a5a17011ae

  • SHA512

    1899f9f7ccdcb7a153dde45542ae7aaf7efea4a80378dca7bf5d9ac4f2528c1f96e39ddc16e297e24e9f43e42fe2caa805358ec858a6325ea0122de95ede80b3

  • SSDEEP

    6291456:1JFmXt8OwI1I7anuE5JMUmx12H5XnDjgeitIvWmNR2:Dct8ONIenuE5JTmxoZTjgHoWP

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 57 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $TEMP/Droid4X/vbox32.msi
    .msi
  • $TEMP/Droid4X/vbox64.msi
    .msi
  • $TEMP/Droid4X/vcredist_x86.exe
    .exe windows:5 windows x86 arch:x86

    092eb6daba2f17cbda102fd1a32acd00


    Code Sign

    Headers

    Imports

    Sections

  • 7-zip.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d6f0c4465a1120873b28751db89680d9


    Headers

    Imports

    Exports

    Sections

  • 7z.dll
    .dll windows:4 windows x86 arch:x86

    37deedb4784101f901de7ee8fdfb81d7


    Headers

    Imports

    Exports

    Sections

  • 7z.exe
    .exe windows:4 windows x86 arch:x86

    a01d0c00ae4ce56b6886f26ab65d8fd9


    Code Sign

    Headers

    Imports

    Sections

  • AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    c64cac39044626770353879245ea25e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AdbWinUsbApi.dll
    .dll windows:6 windows x86 arch:x86

    fda9f9f5f569ddd0dbf3ad8a275a2eb8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AmdSupport.txt
  • BkQdTools.dll
    .dll windows:5 windows x86 arch:x86

    f98454974d1298011caf8fa2bdd1534d


    Headers

    Imports

    Exports

    Sections

  • CensusCore.exe
    .exe windows:6 windows x86 arch:x86

    894afb3806527b81a66ed016be89e320


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • CommonLFun.dll
    .dll windows:6 windows x86 arch:x86

    51c91d24a56bac5c9fe2a803326e21c7


    Headers

    Imports

    Exports

    Sections

  • DXUpdate.exe
    .exe windows:5 windows x86 arch:x86

    a4bde7c6542a1b899d8d2a63cb7ec302


    Code Sign

    Headers

    Imports

    Sections

  • Droid4X.exe
    .exe windows:5 windows x86 arch:x86

    0e09ee631da44c4d398e3a41b156d394


    Code Sign

    Headers

    Imports

    Sections

  • Droid4XPopups.exe
    .exe windows:5 windows x86 arch:x86

    5e332726072bd24054bade7de25de591


    Code Sign

    Headers

    Imports

    Sections

  • Droid4XService.exe
    .exe windows:5 windows x86 arch:x86

    1d3c7db7ab506025a6c019eeabd8a0dd


    Code Sign

    Headers

    Imports

    Sections

  • FireWall.dll
    .dll windows:6 windows x86 arch:x86

    7cb699c829c25c6dcc807a1659a28d78


    Headers

    Imports

    Exports

    Sections

  • GameSound.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    efd8aa3e7b1b9d62c7ec792eab3ec319


    Headers

    Imports

    Exports

    Sections

  • HInfo.dll
    .dll windows:5 windows x86 arch:x86

    f8be97a439c175fa4dcc8ec4b34e28ae


    Headers

    Imports

    Exports

    Sections

  • HaimaBKDll.dll
    .dll windows:6 windows x86 arch:x86

    65b1a0bbb542abcdb3c24361423a63b0


    Headers

    Imports

    Exports

    Sections

  • HinfoTool.exe
    .exe windows:5 windows x86 arch:x86

    7ed37cc248860afe66d6835559d6a5ee


    Code Sign

    Headers

    Imports

    Sections

  • MultiMgr.exe
    .exe windows:5 windows x86 arch:x86

    f28d0fb0c731d05b21eb9d27b9fc48cc


    Headers

    Imports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    9f635822948dbef4661a3440f5d82510


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    74c5c9b67a892fa73c47681d7dee998f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Multimedia.dll
    .dll windows:6 windows x86 arch:x86

    7064d9b7f7f222fb2a74fe7f88cc7b0d


    Headers

    Imports

    Exports

    Sections

  • Qt5MultimediaWidgets.dll
    .dll windows:6 windows x86 arch:x86

    11af94fe2ee4384c5fdd1e6880ccebcd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    4cee52c287aa0ba27607c52d6e17a5f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5OpenGL.dll
    .dll windows:6 windows x86 arch:x86

    0753190ff153e118dc8bdb1ab5a4bdea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Positioning.dll
    .dll windows:6 windows x86 arch:x86

    d6e325f6b698311334311b23b02ba9b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5PrintSupport.dll
    .dll windows:6 windows x86 arch:x86

    a1b506481843150cdc4eb69f15ab45ba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Qml.dll
    .dll windows:6 windows x86 arch:x86

    e9b37c3a2ffa35d490e3bd2db0c7c70a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Quick.dll
    .dll windows:6 windows x86 arch:x86

    63abdb73b90fa5837cb4c2bc8612be9b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Sensors.dll
    .dll windows:6 windows x86 arch:x86

    375bb80b11b58881fbcc867ab17ad291


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Sql.dll
    .dll windows:6 windows x86 arch:x86

    8a7367aced36bd6d68fe89504165e63b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WebKit.dll
    .dll windows:6 windows x86 arch:x86

    8021ad93b224c1f23661890c5df2790c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WebKitWidgets.dll
    .dll windows:6 windows x86 arch:x86

    46849c2db375f6a6c367a57f20df003a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    50f3447adb4b5d70e92f042fd8d465da


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Xml.dll
    .dll windows:6 windows x86 arch:x86

    b192ea86681160544218ea8430976e82


    Headers

    Imports

    Exports

    Sections

  • RepairD4.dll
    .dll windows:6 windows x86 arch:x86

    14d230ad4d1b900d4a73b09c8e6e3f66


    Headers

    Imports

    Exports

    Sections

  • UnloadStatistics.exe
    .exe windows:5 windows x86 arch:x86

    f7ea2ebec1a0b6d3eec4186e2529cb59


    Headers

    Imports

    Sections

  • UnloadStatistics_Cn.qm
  • UnloadStatistics_En.qm
  • UnloadStatistics_TW.qm
  • VBoxApi.dll
    .dll windows:6 windows x86 arch:x86

    141554bd4bb163474092c64462df88b0


    Headers

    Imports

    Exports

    Sections

  • VTx6442s.dll
    .dll windows:5 windows x64 arch:x64

    1aad66ee960d212c3730e3c338f17348


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VTx6443s.dll
    .dll windows:5 windows x64 arch:x64

    1bd30ccefd9462eda4bb1bced95e5233


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VTx8642s.dll
    .dll windows:5 windows x86 arch:x86

    5180654c395396097494f5827306c1ee


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VTx8643s.dll
    .dll windows:5 windows x86 arch:x86

    f75ac1f88597268a1eb4aaa40130580d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VideoUploader.dll
    .dll windows:6 windows x86 arch:x86

    6fc3a5de2757eec06c5460e8e1182491


    Headers

    Imports

    Exports

    Sections

  • Videotape.dll
    .dll windows:6 windows x86 arch:x86

    43c32ce1b6b61f9d4dc8f744d2946607


    Headers

    Imports

    Exports

    Sections

  • WndRecord.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    a6667915020a9d4db2575b49a61e3ea8


    Headers

    Imports

    Exports

    Sections

  • WriteRecord.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    70ccb3d78bcd16ec5b3642c58fac5a96


    Headers

    Imports

    Exports

    Sections

  • aapt.exe
    .exe windows:4 windows x86 arch:x86

    6cae795410282b03a8c84b120ba75b69


    Code Sign

    Headers

    Imports

    Sections

  • adb.exe
    .exe windows:4 windows x86 arch:x86

    879e62881b452fa51161345afb04a6de


    Code Sign

    Headers

    Imports

    Sections

  • avcodec-56.dll
    .dll windows:4 windows x86 arch:x86

    27cb5959a27edff0584eaac6b8ac5429


    Headers

    Imports

    Exports

    Sections

  • avdevice-56.dll
    .dll windows:4 windows x86 arch:x86

    5637608c34f2cc95f2bf73db4baed2db


    Headers

    Imports

    Exports

    Sections

  • avfilter-5.dll
    .dll windows:4 windows x86 arch:x86

    f64ee8201566e3f761bcbe8b89faa40b


    Headers

    Imports

    Exports

    Sections

  • avformat-56.dll
    .dll windows:4 windows x86 arch:x86

    ffbda4d2203e00aca753566cfb1fbe36


    Headers

    Imports

    Exports

    Sections

  • avutil-54.dll
    .dll windows:4 windows x86 arch:x86

    33e9de0a9e4da971e9970d780e2b8609


    Headers

    Imports

    Exports

    Sections

  • channel.ini
  • download/MiniThunderPlatform.exe
    .exe windows:4 windows x86 arch:x86

    39c9c7cd2ff99952b66b87f21b223970


    Code Sign

    Headers

    Imports

    Sections

  • download/XLBugHandler.dll
    .dll windows:4 windows x86 arch:x86

    732b5d4d8fe9352080919202202a8fc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/XLBugReport.exe
    .exe windows:4 windows x86 arch:x86

    2d5eb3318716f6f5924e38fcde089028


    Code Sign

    Headers

    Imports

    Sections

  • download/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • download/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2827932cca8caf8a10f65e148687b7a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/download_engine.dll
    .dll windows:4 windows x86 arch:x86

    d604bec9f17838dae5cca81eba57697a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/id.dat
  • download/minizip.dll
    .dll windows:4 windows x86 arch:x86

    42ec74970cf4f102712a1588d5814466


    Headers

    Imports

    Exports

    Sections

  • download/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • download/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • download/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • downloader.exe
    .exe windows:5 windows x86 arch:x86

    7af2fe87a3ab930007d141d21c36ceda


    Code Sign

    Headers

    Imports

    Sections

  • droid4x_En.qm
  • droid4x_TW.qm
  • droid4x_cn.qm
  • icudt52.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • icuin52.dll
    .dll windows:6 windows x86 arch:x86

    c501ae8dfd4bbf14360eb65c977f12b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • icuuc52.dll
    .dll windows:6 windows x86 arch:x86

    ee05783367e9d6fb6574ce44fef3bba7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • joystick.txt
  • libEGL.dll
    .dll windows:6 windows x86 arch:x86

    63b2828e170822d960d19e9fef465df9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libEGL_translator.dll
    .dll windows:4 windows x86 arch:x86

    316ff617205134b591424e1a696cb995


    Headers

    Imports

    Exports

    Sections

  • libGLES_CM_translator.dll
    .dll windows:4 windows x86 arch:x86

    f7d75c18ef53a636486c4a0437ba51fe


    Headers

    Imports

    Exports

    Sections

  • libGLES_V2_translator.dll
    .dll windows:4 windows x86 arch:x86

    a352c190c37728b5202d3c6a2c0a20b8


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:6 windows x86 arch:x86

    2b9b514e632ae1597f9dbc89a59dba2c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libOpenglRender.dll
    .dll windows:4 windows x86 arch:x86

    6e02c03a756919933900d444e2054fda


    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    657b4797d20fe53fa9afd6c3c66124b0


    Headers

    Imports

    Exports

    Sections

  • libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    8ca18d68f23a7d766f4b9c09847493d5


    Headers

    Imports

    Exports

    Sections

  • libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86

    626ff8f23cb3d32e0f33340852096e0a


    Headers

    Imports

    Exports

    Sections

  • libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    bd28fc239497e62d0f3158fb5e32a191


    Headers

    Imports

    Exports

    Sections

  • local.ini
  • msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • multi_cn.qm
  • multi_en.qm
  • multi_tw.qm
  • ovas/droid4x.ova
    .tar
  • droid4x-disk1.vmdk
  • droid4x-disk2.vmdk
  • droid4x-disk3.vmdk
  • droid4x.ovf
    .xml
  • plugins/NPSWF32.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    f890f4d4cab1581f909d72e286ddd939


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qgif.dll
    .dll windows:6 windows x86 arch:x86

    845cc37eee10cb99ffbb28c049d8e60d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    d1c87a7af6fe8f7cbdf06b3e6ad275c0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qjpeg.dll
    .dll windows:6 windows x86 arch:x86

    4c3c11b4dd86b0d6c3c73978910dc0df


    Headers

    Imports

    Exports

    Sections

  • plugins/mediaservice/dsengine.dll
    .dll windows:6 windows x86 arch:x86

    407597f98c4150045e1bcaa04cacddd9


    Headers

    Imports

    Exports

    Sections

  • plugins/mediaservice/qtmedia_audioengine.dll
    .dll windows:6 windows x86 arch:x86

    b2d77ee9c6270037c646bcafd2bc56f3


    Headers

    Imports

    Exports

    Sections

  • plugins/mediaservice/wmfengine.dll
    .dll windows:6 windows x86 arch:x86

    99a5b97f8889b7757791ca6478f71c89


    Headers

    Imports

    Exports

    Sections

  • plugins/platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    b55e1b7007c7397b1f7aa8b991120346


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • postproc-53.dll
    .dll windows:4 windows x86 arch:x86

    72bd6606236ed6c489af21e376d1a08c


    Headers

    Imports

    Exports

    Sections

  • qt.conf
  • ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    fdd319eeacf85ec03b38cd2da7254df4


    Headers

    Imports

    Exports

    Sections

  • swresample-1.dll
    .dll windows:4 windows x86 arch:x86

    e0f1992403c79d40fef4058a374abf8a


    Headers

    Imports

    Exports

    Sections

  • swscale-3.dll
    .dll windows:4 windows x86 arch:x86

    a52177bfb6b665875571cfdb7fb89c99


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • unzip.exe
    .exe windows:4 windows x86 arch:x86

    7e4a383f9972a88583433be5852d23be


    Code Sign

    Headers

    Imports

    Sections

  • update.vbs
    .vbs
  • update_cn.qm
  • vbox32.msi
    .msi
  • vbox64.msi
    .msi
  • vtchecker.vbs
    .vbs
  • xldl.dll
    .dll windows:4 windows x86 arch:x86

    45468f3a2269a2595f5115a57780c86a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zip.exe
    .exe windows:4 windows x86 arch:x86

    81184a9f7e2b304efdf1fcfabdac9864


    Code Sign

    Headers

    Imports

    Sections