c1c9eb27ba4541f86faddc954759e67bd49d024e26be8c48c036db36dc958527[.]exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

c1c9eb27ba4541f86faddc954759e67bd49d024e26be8c48c036db36dc958527.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 c1c9eb27ba4541f86faddc954759e67bd49d024e26be8c48c036db36dc958527
MD5 d8fc4815b386a5aa486840d81b34b0b1
SHA1 f0a93cbb0ecb6d3062f5251e8dedfafe2cd514e2
SHA512 6c7afd52d3f5a31f30ef8f8677acc840f91e211e5628f633f54c8e97a79cacd5bf903144c9a8d62bcf2af3f67c35546d1176f21aaa10447e96d2e828da11d5fa
SSDEEP 12288:kOIUPPqcbwqkcl+FXbk7FQSlTB5rpJ0Cla+ve7bAvANa24jVZ:kOxycb0cd7Fxv0sjvzE1e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cd:6d:e8:67:eb:e9:01:e5:ba:72:44:0b:59:36:f1:0a:e8:6d:e6:99:ea:00:4f:1c:cd:d8:e3:2b:6a:75:82:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Interradium,O=Interradium,L=Vannes,C=FR

Chains

Oct 14, 2024

Minor OS version

0

Major OS version

4

Entry point

13272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

Javanesere.una

SHA256 f5b5d04030f2bcbc10c0215c973c091b6e84cf39e888908721212fc478938ef6
MD5 b031771dca10777cb87d0a2801ec4a4d
SHA1 31fc7ad53da754d15c24621e91da53ca7c7c7cbd
SHA512 cc526585c23882d6fc20746c296dd6c7e5a1835c72e6057303e1b2d2a6c9409cc55ffba1c2a312375d84c7392fbbaa2e86ace5c0e8f209c5edc97627e57e1066
SSDEEP 768:hGUmUq4XncDuopMAmkSdbqsLNcdYMwdx5pYZIDzDGwd5v9E5wKzBVBUkCTll0epz:Xmi313Zr3Dqo9Auic
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Nothingizes.Del

SHA256 7c753e65e9f3ff1b589ad15f40f03722b1a07b0ac3ae1804ebfbeee876a26c7f
MD5 146abce235fb90c00f10fd1119046864
SHA1 88d6cbaf89ac84385be11174d84b1529bfb966c3
SHA512 aca2367614f99f54e8a0a11ad7f56976bc6bf5973142ab3aff638314459124fd446a4e8767c989bb4b42054172344ceaac35570136d7961a1aac311fe7a6ecb6
SSDEEP 1536:18hpCLvEh3Wwf7rzgld2IDaR7WbCg1Ix9Wfc39P11MICjf+8VKjInD:Wlh3W4HgmWM78f+Q28ZD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Stenos223.hof

SHA256 aecd2d7ffc06f27489e964265b5a7f272b66fc759978be63079bb25d0bb18cf5
MD5 b7141eaad1bf0756d267fe61f33d954a
SHA1 50273ade0e1a2e60015a4c55ffc2a50a14afd67e
SHA512 a92b06c0121f00d99ba9ee0af58af9d5bf562ab50f144a9b6c470074a74ce88c7a12273516588b00a0358a4abaf082c648543404d7f702a8f8f0b002aac0a2a7
SSDEEP 768:IKv21sC8JM4X8rzq7SyllkfM3wAhCW2VfoFlIXclfKxfVZ02HhIFHmKZfrWj7sB3:dGAZS03wEMRsctr6fv8U1iw6MYe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ekkoer.ski

SHA256 c5858812fec1e212fd5917167e61a2b4ec70c80c3c8fbbb6b08d5d0e4e71b632
MD5 dd9935189278cbe33db1610279d33a61
SHA1 7de27de465a15b69c282ed95e9fc9bbe0d8ab193
SHA512 3e0d389137f66ffdd26d7c0e34ebcb76aa69bd5498073d46438eb1e7686b723df4764c62783b22e670151073c8722118892e4d89462f02c145ef3136fa19d0e0
SSDEEP 768:dghM76bpC67WKzXYJUcbS9OaehRYveLdoBNJZ+0VFw3wiuUMXZqJtyT33CFzMdyb:KLWeGm8mN5TnCRXzPED3/YQiJ9MO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

midtskibs.txt

SHA256 4489a9b0b9efe25d0ea9edd6848a018b36b03ff655a76e45fe7827978b4b9250
MD5 c08c845a427bcb3acdab38d6a60e4c60
SHA1 30f6bf1e8e00d8041aa8e154bf5c31d5ae66132d
SHA512 f643561861c45ecb579e1e2e74db84cc818fe0178e9e62efe95f883430624f2fe4c83806274a30678e80d27386bb6d45af80d7922268c9d9ceb2636b73ae2fb6
MD5 SHA1 SHA512

NSIS installer

installer

shivaistic.rig

SHA256 e0650dc01dbf7a68cf2da308f3dba79ff7d0262fab3f7bf9e8a5a4c9811b2d08
MD5 d214dc306cd7d2a11ad6f083fae4cc2b
SHA1 5a3f282073936f701e4f731f116b6d1f6140e610
SHA512 cef4c641e38349eee0466194e28c7db8da13d44dd2ce8127686ef13ed5722876ee8275deffb6803d2f337379da859ab51cc12a81965c5bbb6aba257677e7d3e6
SSDEEP 768:KW+r7LctmdRqSKgtMxaSqkSgjAUPKzbukqiqvQzNaV6N5jsmhRSR932V/0oEd70N:Acc3KjHmQ/dfSmkRJEvb/pIPCZMEk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

stripped.Sty

SHA256 51b703eb8e507a0a7abd59f48a835fd8affe03fb73174065a7f9ff9348083e4a
MD5 af012684f567d701ba2abad5020f0b5f
SHA1 ee477a26099f59c952d1bec54a0d98fafbd44781
SHA512 519777c6684bf8dd57cb3286c0a75869c951abff9ef18f368aca0093e03b599fc6341efc35157fbf0fb3a6106f6bec64306d164cbb588141cafe0f565275d640
SSDEEP 6144:n+HuCzsq/ddc6xFLBwkerghCGZOtLaLRzkWHqNurUT:nCzsjULBVergVeatzPKNx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer