SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i[.]exe

resource
SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 383d758b111ebf7255078b12d04f9f0e39ea4f85733563344754cbaad4bf0581
MD5 e7ebd3de4bcba42feee0d2bd98521920
SHA1 71608b8fd542467e554766de37cdc8244c84286f
SHA512 8810494095ec08538084adc8c788795fa864c8d14a3cb764f6eb31164911c007b1a1c4faec69426dcf348ad9cc9ca38a786376ad9a5d2ee3b527c50588ab2c32
SSDEEP 12288:OLAv+r2OUwOGrtWhAefluH10OkBUEdJ240xvahGuY6o/iv6kqYd/l7EsEh32vA6:gK+y7wOOtzeA0hp9uYGP/6DzvA6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kontrakttillgs/Perruque.ing

SHA256 4c232e2ecf884cfb880063a1965e3bdb9a6c79f2fa92cd88f6c7e6779e6da73b
MD5 ddd2489ddfc524e9ee509a9f23fb902b
SHA1 b9b6684ca4d8a8b995c1603e7c19726784eee000
SHA512 bab10f980bf0df1e2801a7198836604bdda1565d798cba5917fe74ff9a7575738aa9a28484496f9057ccd6916c1a76851264bf6abd0112323714d5457c0d41e4
SSDEEP 768:J0z6wdM0UhwfIaiNOwn6bSGd014Z8uxG:JcsGdu4Zy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontrakttillgs/Shrapnelen.Mye

SHA256 2ffe647e7b470c383c0a750b2d4e6d793e0fd17ed98cc21713468dc0b8c0c849
MD5 36bb7469e45cc4b996211e55cef3fa3c
SHA1 1b99c8904ed078ab68bd7fd102fa9858b4934178
SHA512 bd7ebfcee38c06f509ad901c8a631916988be9dd3ac45a305e815b3f7c72ba3f80310bf0571175769e9d65d66f11bc29649c6eb7dc0b6cb09b540f57dbd20799
SSDEEP 6144:WJvjV3qwOFGkUWbNGKzNvROY80A+87aBjci6h6WYISRWP0orkadn:WxArFGkUMAJYx/8aBjcZMWYIOWcwkadn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontrakttillgs/Slettelandene.chr

SHA256 182b621dbe6d3c8da69dfeab3d669ef39583cdd08924b8fb40d4d8c66caf0ed7
MD5 43c93be687df1feadfb2875c59b2b0c6
SHA1 b73bcf95842f90a848e9ed8e93b16dd2c65342ca
SHA512 491f384f93aecb7553d33fce4ee576d9e44b6981202af648c3369449f76568a87de1b466904fe370c8721aa509ebf42236c8ea126ad3f88c24b3372a0f041a36
SSDEEP 768:9bJxjjqJeE5S9s6szcH7FgY8bY4wt29WrBWstS2uVFyIRT63fBmdzzjIWEzHX+Ln:bx6v54sbUFOY928thNPCQWE9Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontrakttillgs/Stures.ped

SHA256 384ab607c9de2127413622ab57f6b7415cee138009b9ec333cf7a3564770f33f
MD5 26d18c98fc2bbddcc2eabece2b7b7f7a
SHA1 b4b1e5a647d978fe16fcdca2cef87d526692e5ca
SHA512 e23e0ceedbff28b216c66bbcabe3422d63daa48576e9c74c230fb728c3639b3a43324da765d5b9a65428bdb4d420bdc9feab97ce2f63a6849f8b54beeae2afcd
SSDEEP 768:ADeNhGs9RZUw+t2FRLS3kHxI5Sgm5tKOqSDKljjuss7LkXRnxTOx1wMZSYS4t7es:9tPgCZeaweSFE6+0ORTiYpkDj5n25
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontrakttillgs/anchorets.ndr

SHA256 1d24ba37a824dfd8634735d26a476d5d373d1957c87649cb6f13ae4a80e4bd6c
MD5 d307e67597944ce2ef28f2327b44806a
SHA1 54088a21ac7ad116a026afddad56eba053aecea8
SHA512 8e6a019fbd15f36b38249108413cf669e1f5ffb3b49677877356c2eb45c4f2e04cb1509add33483ae1d84d14e83aa108ad0672f208dc683c2b1dfa2c94841b18
SSDEEP 768:9XbhQfa5JLTv4IpFOrnxsCbpcSmgnKRYbfROeHfGA3hqDwfO7vpbWckbUvdb+FKd:9rzGxUsfSpdQmXLfWi80/APsuZnHaec
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kontrakttillgs/degelatinize.juv

SHA256 fe2499bac94d1e864a127d1c923eaa55cdd7db247a65765d4024ee65ee2f191b
MD5 4152abe0e93a89eddea6ad43943d345d
SHA1 97d61b7f616eff3894f98cd1167ede0c4484e969
SHA512 01b4f62edbfef0a1ad17df2840f33fdf3f6858fd06bc2c50ebdb41ac4a9fad3d9933048befee6b942950c08d17d809369591f120f0d8cdedddcb4c9487c3f5d1
SSDEEP 1536:Q4/fVNwA7vKgOXpUUQ4Bm6OwhTAQc3uRQJK:QAffweOOUc6/zHRQJK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kontrakttillgs/Perruque.ing

Kontrakttillgs/Shrapnelen.Mye

Kontrakttillgs/Slettelandene.chr

Kontrakttillgs/Stures.ped

Kontrakttillgs/anchorets.ndr

Kontrakttillgs/degelatinize.juv

Sharing

General

Malware Config

Signatures

File Explorer

SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Kontrakttillgs/Perruque.ing

Kontrakttillgs/Shrapnelen.Mye

Kontrakttillgs/Slettelandene.chr

Kontrakttillgs/Stures.ped

Kontrakttillgs/anchorets.ndr

Kontrakttillgs/degelatinize.juv