eb63d3d88459c389d3bbf1e307d8a5e40d8ac30c4e9f8b03150e2d4c250896e8[.]exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

eb63d3d88459c389d3bbf1e307d8a5e40d8ac30c4e9f8b03150e2d4c250896e8.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 eb63d3d88459c389d3bbf1e307d8a5e40d8ac30c4e9f8b03150e2d4c250896e8
MD5 14ed33e066dd06f67f6890c5253a6d00
SHA1 b3fe5ea7789b82a37a23237dd323ab5ab724d9fb
SHA512 3a3bd3469985f593881b7846e94a7106135a44595410f9e50af3ee71b1d287b1b11b590f97a720f1c8fdf252ae2b4d5936bba93f12ef34122b9b6ba86a2ff713
SSDEEP 24576:YVTcsrgw7l34QD+rjndm1j1LO191KMiV6X97W2Gnm3Tw29:YVcOgqBK+O19LiV6tS2Gnm3TH9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

59:9c:6e:ba:7d:f6:db:f0:0b:1c:e0:73:a0:1d:5d:de:80:74:ed:4e:29:40:c6:bb:4f:fb:a3:98:e6:4a:13:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Miaotse Nondeterminately\ ,O=Chronographic,L=Ratenelle,ST=Bourgogne-Franche-Comté,C=FR

Chains

Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Briksen/Bevarelse.lag

SHA256 c57e5c23732514268beb693ececb4e1cb7bd06423bb7117bd585d792a7b8f6b7
MD5 f975f5cf67b024064aa95cc10594ed58
SHA1 ff6dfe88bef527469f7c4e5a3d3060633b559d5b
SHA512 9b3dd92e47134fd4f2d25657e45c519751210d0f407a1605bf2e4373c2a8ff22394f6344fbde354d05ddab2230307f124408ed41f12c11332fbef631e0eab457
SSDEEP 768:LLZAlwTFVKXJ4ZuiegTwWT/30ErHUJ46Ib2jt4wu:Lul0z28
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/Interviewteknikkerne.lan

SHA256 1cee08d79a864053fbb13763bdf23f43f36b33c4e02297762126fab30962bba1
MD5 69b4c186d4b99c5b11b8bfdb1455bd45
SHA1 3aa83299e320dab7716c78c2b56a0b6c50bdc0c3
SHA512 9aca1539acdd72a5d84bf63d9cbc24ffd6c8069fc8b481aa210b33ad6af427bb88096b98b025610424ba25ee190ac791bc74edcfa74edfb2995636636c0e0bd3
SSDEEP 1536:6yWFtXDDWbtJ6RSgVSfypxy9KvnVx881/x+OH:LXtmSgVWyG9CnQ8NxZH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/Tiane.bal

SHA256 87c2511f1d34e14b5f9bc5ac16a7670ca953a6a9ec2bf9153405181eaeb38e31
MD5 b23a6b957b858b34857acae3d1b4597b
SHA1 3c736f240c2bc30ad735ed7afeb1e8df3781cd02
SHA512 b70e6877f0c532506156e91f4db00e81a27c89b48afced029db3ddacd9807175061bae745962898236bbdba4b81c655aac444888d3f4622cd79b7c9cc8fa05fa
SSDEEP 1536:JNgGqSb/ZqY2zkDTTptM0dk79vhvh7zBUqN:Xv7QlQ/TptFd8v/79Um
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/bremia.sur

SHA256 e68c142225d896ba7ccd9614547e8b7a75625f3b91f000654276ed645cb39a94
MD5 bfce0682c97b62114829396fd5315c56
SHA1 ea406aeb44a0f846764eff6687bda613cf1fd2d6
SHA512 f9c196a36556789c4c23f88718270d1ffb7fe19454a8076a414996076859fdff486657cbf3bf6a14044fe3de8420dafa98788a0a47520c6c269e0ef04619d3fa
SSDEEP 768:VTZAWiIr0To35UZ7cuoF9/Ism4m6ERg4ZCkCEbwf7GPI1B1NDr9Pl9QEYsfpg+uM:fid6gxTVbIJfQKuhSxv32XrdfRLtOeO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/frafaldene.pos

SHA256 a2341753d7b40e5e744fc3679939b20d6a2404f81c04ea7ea64e4c0f12747779
MD5 11d548a8091d32c8bd2f1d8459e907b7
SHA1 853b693379a65f337c6167eaf76bea930adaa993
SHA512 fcfdd634888bedfe9112be6307165311b36cc03feff0e5b174986597e49aebb6deb309a5eac5ba587d10505d17e32405b7ca658a1e03412aea18e5cddbf857c9
SSDEEP 768:VJ2cn0kAbmWsZn2jq/vJ2siaGFXIh6s6/evsAsd1FRbQ1uGDNKm0tyvsB5OFPfD8:a0n2qh+5HFRyYex3XcHt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/stahlianism.reg

SHA256 4fb6df07561498b48942eacf026e1d80c2fd912c12ea6178021a7f0ac983e049
MD5 1d07b8fc29ffc122f84d2934fa4a3a74
SHA1 83d4c8ecd2183e37ddf9736255fc65daf0b0be0d
SHA512 8be0a2818a21ec1987589a80c0cb58b2cbd9bf88057b80e22e96c28dd9c2024091a06d3a9f51963b2fca58912b700bc25a79bf60289a9abe8edbcf09782fbfd8
SSDEEP 384:5G6mqQ0Wpr/NE4SXpMkem0N5IOaWtABFBksK7S5eiKtXyeVDD96Fp80fyNyejo0V:WqQ0WHE4SOT0FB8ye8Gcy0Eo0iT8X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Briksen/strophanthus.txt

SHA256 2b7c35e9ecb0767316506238710c1ebf85f2de5763560f059fa8b6fe252be356
MD5 78dadf5ff86a0e757c4e85fcc473da96
SHA1 dd6155f49243f9b8b057ae6c6686d2b4fc482b38
SHA512 206fd7eb8b67f833ba0c50bd996a61e121d1c81e18b71cc61500e2689d7abfb1b5590ea7c844846ebe59b13d3ab846e3659abff9f864a80690964789677bab23
MD5 SHA1 SHA512

NSIS installer

installer

Menise/Knibningen/Eloxals.Fei

SHA256 448bd98efdf1b974ebceadef36c80d27f684440b86344754616a980ca0e3ebca
MD5 58db041d563070f2edb4173bb063620b
SHA1 ad3d9c5c1dccf7f5047f5f955884b0c91c190803
SHA512 b94cfe76789de191721f2a966b34b6975a3f276d9b74d410c1424378ca0823d06982a14ef05fed60b701694a15623cfc8ffeb0cb5aa4c68433ba4154df91f21d
SSDEEP 1536:0qSvwUYBTIKeMHWAXRcYWEhmuSBxIy6ABz6eAlNxqFV+j+mnMWnWCHUSoBR/M:05hYTjrBFjhZSQAZ6eALoFATnMJiofM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Menise/Normeringerne.Ava

SHA256 2b1502799cf04f7643fd449af29ee76ba8e201098e2980f6fa58e39c5c7a3907
MD5 e9686d07eebe8ea1ad485f799cacbecd
SHA1 8adb66f78ff878502fb9b8f1e287e0c06f42ef24
SHA512 0f0a8c3f690d8b43097dab37cb527b4f3f064ce556af01065eacfa158bc4c0dcc3e391a62ac641df34a40097c3121b89e1715dbbc9a1b756df4533f37d176044
SSDEEP 6144:ntoRkAmQes/KbcVWCfSMeGkSNnhHBDhEkioo4Fza7HXbn2X+9h2l:fAmBs/KbcVtSzGk8nhHmoLNmXM82l
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer