986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee[.]exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee
MD5 bd22643b99f43bba3a8879e31769104f
SHA1 9cda02098e71ac53e3c9952d08b6f084f2162f5b
SHA512 672f789f1cd6b67721a20763ec0b7c27a9b2280e9f1407d3ba675c41b2d52bf3b818f6c4fbfe97e5152080a6665ab92a262003e008aa2279c325ab39a8e4efd7
SSDEEP 24576:NVTcsrgw7y6ry23mjDVWhRcgBS7W2Gnm3Tw2L:NVcOgv22/uR3cS2Gnm3THL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

54:9d:9f:a9:d8:cc:c1:13:b7:dd:68:b8:52:47:f2:20:0c:37:81:5f:ad:64:a3:9b:c3:c5:95:a5:fc:4c:23:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Blain Woodfall Balletternes\ ,O=Strabotome,L=Cataldo,ST=Idaho,C=US

Chains

Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Biologics.Afv

SHA256 ccdf50ed35b8bd2d685405b969b8b9794c884972690ee9b7400db82f81c76a0e
MD5 0409ec7a344932abc7eca4333b693241
SHA1 f481663c3fa443fad9ccb5dd56b467f020cee03b
SHA512 06650ddf3200fdde2beb37b17dbd5d133cb572a0869721334cde46ea4df218ac344a11b0517c6b446b0417370495480b7a8a07c4dda33d627c69ebaf265ebd6f
SSDEEP 6144:H2m1Hj0KuAw0hDwhsrCBD6tvcpE8XshDCA/lA/I/mva8g2u9:DHj0KuAxDgsrCB6A0hDCAy9by
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

incapacitation.Unh

SHA256 48924fb0a43d9db9e07e2214ba0c62cdd20f1a856b125bacaa2defd852e4f64c
MD5 1867865761f93c40ceab3493e90aa06a
SHA1 980ec2a8634d3b25d8061edf7107321de587ee7e
SHA512 f712c18ea480543ae2b7da30351560810a5220ff7fa9aaf7f6af2493a297e6168c9d2571c9def4b141c1f1a0f7bcff784b136070cbc3b71be2bef8bdc7a1244f
SSDEEP 1536:y6HZLDxlzQiUlWAK7+NvDp+Ngx9npBrtRR5LtcDh7n:y6HZxV6lW7+NMmJtjdC7n
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/Bevarelse.lag

SHA256 c57e5c23732514268beb693ececb4e1cb7bd06423bb7117bd585d792a7b8f6b7
MD5 f975f5cf67b024064aa95cc10594ed58
SHA1 ff6dfe88bef527469f7c4e5a3d3060633b559d5b
SHA512 9b3dd92e47134fd4f2d25657e45c519751210d0f407a1605bf2e4373c2a8ff22394f6344fbde354d05ddab2230307f124408ed41f12c11332fbef631e0eab457
SSDEEP 768:LLZAlwTFVKXJ4ZuiegTwWT/30ErHUJ46Ib2jt4wu:Lul0z28
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/Interviewteknikkerne.lan

SHA256 1cee08d79a864053fbb13763bdf23f43f36b33c4e02297762126fab30962bba1
MD5 69b4c186d4b99c5b11b8bfdb1455bd45
SHA1 3aa83299e320dab7716c78c2b56a0b6c50bdc0c3
SHA512 9aca1539acdd72a5d84bf63d9cbc24ffd6c8069fc8b481aa210b33ad6af427bb88096b98b025610424ba25ee190ac791bc74edcfa74edfb2995636636c0e0bd3
SSDEEP 1536:6yWFtXDDWbtJ6RSgVSfypxy9KvnVx881/x+OH:LXtmSgVWyG9CnQ8NxZH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/Tiane.bal

SHA256 87c2511f1d34e14b5f9bc5ac16a7670ca953a6a9ec2bf9153405181eaeb38e31
MD5 b23a6b957b858b34857acae3d1b4597b
SHA1 3c736f240c2bc30ad735ed7afeb1e8df3781cd02
SHA512 b70e6877f0c532506156e91f4db00e81a27c89b48afced029db3ddacd9807175061bae745962898236bbdba4b81c655aac444888d3f4622cd79b7c9cc8fa05fa
SSDEEP 1536:JNgGqSb/ZqY2zkDTTptM0dk79vhvh7zBUqN:Xv7QlQ/TptFd8v/79Um
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/bremia.sur

SHA256 e68c142225d896ba7ccd9614547e8b7a75625f3b91f000654276ed645cb39a94
MD5 bfce0682c97b62114829396fd5315c56
SHA1 ea406aeb44a0f846764eff6687bda613cf1fd2d6
SHA512 f9c196a36556789c4c23f88718270d1ffb7fe19454a8076a414996076859fdff486657cbf3bf6a14044fe3de8420dafa98788a0a47520c6c269e0ef04619d3fa
SSDEEP 768:VTZAWiIr0To35UZ7cuoF9/Ism4m6ERg4ZCkCEbwf7GPI1B1NDr9Pl9QEYsfpg+uM:fid6gxTVbIJfQKuhSxv32XrdfRLtOeO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/frafaldene.pos

SHA256 a2341753d7b40e5e744fc3679939b20d6a2404f81c04ea7ea64e4c0f12747779
MD5 11d548a8091d32c8bd2f1d8459e907b7
SHA1 853b693379a65f337c6167eaf76bea930adaa993
SHA512 fcfdd634888bedfe9112be6307165311b36cc03feff0e5b174986597e49aebb6deb309a5eac5ba587d10505d17e32405b7ca658a1e03412aea18e5cddbf857c9
SSDEEP 768:VJ2cn0kAbmWsZn2jq/vJ2siaGFXIh6s6/evsAsd1FRbQ1uGDNKm0tyvsB5OFPfD8:a0n2qh+5HFRyYex3XcHt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/stahlianism.reg

SHA256 4fb6df07561498b48942eacf026e1d80c2fd912c12ea6178021a7f0ac983e049
MD5 1d07b8fc29ffc122f84d2934fa4a3a74
SHA1 83d4c8ecd2183e37ddf9736255fc65daf0b0be0d
SHA512 8be0a2818a21ec1987589a80c0cb58b2cbd9bf88057b80e22e96c28dd9c2024091a06d3a9f51963b2fca58912b700bc25a79bf60289a9abe8edbcf09782fbfd8
SSDEEP 384:5G6mqQ0Wpr/NE4SXpMkem0N5IOaWtABFBksK7S5eiKtXyeVDD96Fp80fyNyejo0V:WqQ0WHE4SOT0FB8ye8Gcy0Eo0iT8X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

voldeligst/strophanthus.txt

SHA256 2b7c35e9ecb0767316506238710c1ebf85f2de5763560f059fa8b6fe252be356
MD5 78dadf5ff86a0e757c4e85fcc473da96
SHA1 dd6155f49243f9b8b057ae6c6686d2b4fc482b38
SHA512 206fd7eb8b67f833ba0c50bd996a61e121d1c81e18b71cc61500e2689d7abfb1b5590ea7c844846ebe59b13d3ab846e3659abff9f864a80690964789677bab23
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer