Oogoninia[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Oogoninia.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 9b00715d77438200a4f54fa8f47ac17aab0cc166e95fc6737c2a78021b69a64e
MD5 18fb2cccaa9ac71624eaceada006e938
SHA1 a25055a3b29ce0ee64d7e20eccced0f72ec737db
SHA512 5828d7ee60e66afac8d3650930ed8556adc9693ab32ca872cc16f71382568baa471827cee1162393b7bce2c725965bd92377e7960225e43e00aef87754a2215d
SSDEEP 6144:SyI5s2239XH7ySqrVWOqnBRryl2sIgghQtUnQl8uFfKIn4jma8LIwJzSdfoVLg68:H22tH7L0kel2sInQDlxnPn906OLhsI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

25:44:f3:fb:5c:c7:c3:0a:27:4f:e5:73:54:fd:69:fe:cb:1f:c1:ae:7b:4a:69:ef:ea:e8:f3:ec:bf:98:69:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Foliating Escapisms Uloid\ ,L=Chertsey,ST=England,C=GB,1.2.840.113549.1.9.1=#0c234b756e64736b616273726967657340556476696b6c696e67736d6f64656c6c2e4b6174

Chains

Sep 30, 2024

PE Signature issue

Digest

da:3e:f7:27:a2:2f:ef:3d:3b:67:aa:b8:39:55:54:aa:4e:c5:6c:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Foliating Escapisms Uloid\ ,L=Chertsey,ST=England,C=GB,1.2.840.113549.1.9.1=#0c234b756e64736b616273726967657340556476696b6c696e67736d6f64656c6c2e4b6174

Chains

Sep 30, 2024

Minor OS version

0

Major OS version

4

Entry point

12672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bagpaa.Mon

SHA256 375d0775b3fd050c4ae89f99abe1c2d71697d3180b32537ec3dffc320f81e9c4
MD5 882a0d458279279c786d38a56f20b77d
SHA1 010e3688fc482a7e98e8c60baffe73f57800ee77
SHA512 d52d469138e7fcd0b392eb8964e624e6fc0d60f23653b30827ac19bbcff7d62968d4692ccfbdda57e3d8cd42cfa1bf791321dd6436f48c1c9c4bec428a8330c0
SSDEEP 3072:BGo1P6b7nn68mltqdZl30ciddrEHJsP2JC:BGQP6b7npmTsp0c0RSJa2JC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Condign.Str

SHA256 1211392b8b3d61cf8ed4dbed0ad6ff93ae608faa1e9b124a55b60d33ab281a9d
MD5 afd211403054996bd48e1a48ac7f7fe2
SHA1 9eabf5e146f2fca57906e46b81012f6b3ca02157
SHA512 6c3a43a1b18d341357e902e317fcbda55284c34339ddf3e6fbd03481a92aa86d49794f5a7af488cf29c7d459c2f67bc78ebd5cd0500b55f34823681c5d636ff4
SSDEEP 6144:Qsi43bNkvibXjg2tgcFhhOGwcjuYpj1CbTD:A43byvib0spDhO/Muq1WD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

alsmekill.sta

SHA256 34dc9b70d0ce5223a531e499611f1208f3ae85aaef9973fc27e89190568f8ee2
MD5 f6a8488b1b62b7ac3b0979c8fbeabb30
SHA1 9725896ebc26ccb2cb9060640b9e0d4a0618916f
SHA512 88a719685d0972290632c6b5a665184e79a98be22b76af28f18056f2e7a721a0b2d3b4a8815bce562426643e69f998f9e45f3ca62b3288eaafb71fe89a23ad20
SSDEEP 1536:JwpZQcXbJ+mf8ME8s+dg5Z90uGaXF9Pl7:W4cX8ncmxhGm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

boat.ast

SHA256 1d3d52ecb41f725dc23080acb1acdfedf29bb5f167dcb75f89af837888421880
MD5 9911b32fe219697a738f39ae5766b512
SHA1 da67ebb043c778deea874e1c746483a2b65e533c
SHA512 fbf703cd56434bb14c6a1a34878f094be183d9f638d0f34074f7ee4c9d12db70a833679b496fcb1e4c6050c418a906221149aac70035bcda3c01d4272c0fe3e8
SSDEEP 768:WqBSYr/TzktUI9ql+6iD8iDu43pfrmQ+PHlyjwkZY51UG90JdfSDUsby4/FApmbO:I3TS9ymKhysrQEkRbwvL3xcbNyFN2Mv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rupis.txt

SHA256 6a7feebfe1f4330e611e6e1b3804619d329a9d3abd3a3ecbd9d441f884e9999d
MD5 668a01d3af55a42fbfdbb1e9dd730b59
SHA1 e0949d489a15516b3cd09f1043543c38e3688f1a
SHA512 cf3f03583667362adcea4deb094513b84d3e275ebcc42a993f9293b7374618a1ba060d4c4bae446c02b329dde2a4579c152f54a1f7537a0f83a3e88406509459
MD5 SHA1 SHA512

NSIS installer

installer

Oogoninia.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bagpaa.Mon

Condign.Str

alsmekill.sta

boat.ast

rupis.txt

Sharing

General

Malware Config

Signatures

File Explorer

Oogoninia.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bagpaa.Mon

Condign.Str

alsmekill.sta

boat.ast

rupis.txt