General

  • Target
    rcsetup154.exe
  • Size 25.3MB
  • Sample241015-3slegstake
  • SHA256 dbf0895d886b428c8465ee57aea56a7e7b6e4c003efd04ca00d216a2d821eac9
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • rcsetup154.exe
    .exe 25.3MB
  • $PLUGINSDIR/ButtonEvent.dll
    .dll 5KB
  • $PLUGINSDIR/INetC.dll
    .dll 23KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/g/gcapi_dll.dll
    .dll 348KB
  • $PLUGINSDIR/modern-header.bmp
    25KB
  • $PLUGINSDIR/modern-wizard.bmp
    150KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $_107_/$_107_/pfUI.dll
    .dll 18.2MB
  • $_108_/Montserrat-Regular.otf
    44KB
  • $_108_/PF_logo.png
    .png 3KB
  • $_108_/RC_Computer.png
    .png 82KB
  • $_108_/Recuva_Logo_72px.png
    .png 9KB
  • $_108_/lang-1025.dll
    .dll 44KB
  • $_108_/lang-1026.dll
    .dll 46KB
  • $_108_/lang-1027.dll
    .dll 51KB
  • $_108_/lang-1028.dll
    .dll 27KB
  • $_108_/lang-1029.dll
    .dll 46KB
  • $_108_/lang-1030.dll
    .dll 46KB
  • $_108_/lang-1031.dll
    .dll 49KB
  • $_108_/lang-1032.dll
    .dll 52KB
  • $_108_/lang-1034.dll
    .dll 52KB
  • $_108_/lang-1035.dll
    .dll 48KB
  • $_108_/lang-1036.dll
    .dll 52KB
  • $_108_/lang-1037.dll
    .dll 40KB
  • $_108_/lang-1038.dll
    .dll 50KB
  • $_108_/lang-1040.dll
    .dll 50KB
  • $_108_/lang-1041.dll
    .dll 32KB
  • $_108_/lang-1043.dll
    .dll 52KB
  • $_108_/lang-1044.dll
    .dll 46KB
  • $_108_/lang-1045.dll
    .dll 49KB
  • $_108_/lang-1046.dll
    .dll 48KB
  • $_108_/lang-1048.dll
    .dll 47KB
  • $_108_/lang-1049.dll
    .dll 45KB
  • $_108_/lang-1050.dll
    .dll 51KB
  • $_108_/lang-1051.dll
    .dll 45KB
  • $_108_/lang-1052.dll
    .dll 47KB
  • $_108_/lang-1053.dll
    .dll 47KB
  • $_108_/lang-1054.dll
    .dll 44KB
  • $_108_/lang-1055.dll
    .dll 46KB
  • $_108_/lang-1057.dll
    .dll 48KB
  • $_108_/lang-1058.dll
    .dll 46KB
  • $_108_/lang-1059.dll
    .dll 48KB
  • $_108_/lang-1060.dll
    .dll 48KB
  • $_108_/lang-1061.dll
    .dll 46KB
  • $_108_/lang-1062.dll
    .dll 48KB
  • $_108_/lang-1063.dll
    .dll 48KB
  • $_108_/lang-1066.dll
    .dll 46KB
  • $_108_/lang-1067.dll
    .dll 45KB
  • $_108_/lang-1068.dll
    .dll 46KB
  • $_108_/lang-1071.dll
    .dll 50KB
  • $_108_/lang-1079.dll
    .dll 47KB
  • $_108_/lang-2052.dll
    .dll 26KB
  • $_108_/lang-2074.dll
    .dll 48KB
  • $_108_/lang-3098.dll
    .dll 48KB
  • $_108_/lang-5146.dll
    .dll 46KB
  • $_108_/lang-9999.dll
    .dll 47KB
  • $_24_/$_24_/InstallerHelper.dll
    .dll 12.9MB
  • Lang/lang-1025.dll
    .dll 44KB
  • Lang/lang-1026.dll
    .dll 46KB
  • Lang/lang-1027.dll
    .dll 51KB
  • Lang/lang-1028.dll
    .dll 27KB
  • Lang/lang-1029.dll
    .dll 46KB
  • Lang/lang-1030.dll
    .dll 46KB
  • Lang/lang-1031.dll
    .dll 49KB
  • Lang/lang-1032.dll
    .dll 52KB
  • Lang/lang-1034.dll
    .dll 52KB
  • Lang/lang-1035.dll
    .dll 48KB
  • Lang/lang-1036.dll
    .dll 52KB
  • Lang/lang-1037.dll
    .dll 40KB
  • Lang/lang-1038.dll
    .dll 50KB
  • Lang/lang-1040.dll
    .dll 50KB
  • Lang/lang-1041.dll
    .dll 32KB
  • Lang/lang-1043.dll
    .dll 52KB
  • Lang/lang-1044.dll
    .dll 46KB
  • Lang/lang-1045.dll
    .dll 49KB
  • Lang/lang-1046.dll
    .dll 48KB
  • Lang/lang-1048.dll
    .dll 47KB
  • Lang/lang-1049.dll
    .dll 45KB
  • Lang/lang-1050.dll
    .dll 51KB
  • Lang/lang-1051.dll
    .dll 45KB
  • Lang/lang-1052.dll
    .dll 47KB
  • Lang/lang-1053.dll
    .dll 47KB
  • Lang/lang-1054.dll
    .dll 44KB
  • Lang/lang-1055.dll
    .dll 46KB
  • Lang/lang-1057.dll
    .dll 48KB
  • Lang/lang-1058.dll
    .dll 46KB
  • Lang/lang-1059.dll
    .dll 48KB
  • Lang/lang-1060.dll
    .dll 48KB
  • Lang/lang-1061.dll
    .dll 46KB
  • Lang/lang-1062.dll
    .dll 48KB
  • Lang/lang-1063.dll
    .dll 48KB
  • Lang/lang-1066.dll
    .dll 46KB
  • Lang/lang-1067.dll
    .dll 45KB
  • Lang/lang-1068.dll
    .dll 46KB
  • Lang/lang-1071.dll
    .dll 50KB
  • Lang/lang-1079.dll
    .dll 47KB
  • Lang/lang-2052.dll
    .dll 26KB
  • Lang/lang-2074.dll
    .dll 48KB
  • Lang/lang-3098.dll
    .dll 48KB
  • Lang/lang-5146.dll
    .dll 46KB
  • Lang/lang-9999.dll
    .dll 47KB
  • RecuvaShell.dll.new
    .dll 297KB
  • RecuvaShell64.dll.new
    .dll 375KB
  • recuva.exe
    .exe 16.8MB
  • recuva64.exe
    .exe 20.1MB
  • uninst.exe
    .exe 4.1MB
  • $PLUGINSDIR/LangDLL.dll
    .dll 5KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $_24_/$_24_/InstallerHelper.dll
    .dll 12.9MB

rcsetup154.exe

  • IMPHASH 61259b55b8912888e90f516ca08dc514
  • SHA256 dbf0895d886b428c8465ee57aea56a7e7b6e4c003efd04ca00d216a2d821eac9
  • MD5 SHA1 SHA512 SSDEEP
Digest
36:c6:90:75:80:96:e5:67:36:cf:38:fd:e6:bc:ea:9f:27:33:d8:d0:e0:3e:aa:aa:d5:9d:22:03:98:1e:bf:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=08235567,CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths