cf2afee6c1871706deb922c7105c9e5bf6a2bbaca312b1b4ec4951dcfa033ea7[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

cf2afee6c1871706deb922c7105c9e5bf6a2bbaca312b1b4ec4951dcfa033ea7.exe

IMPHASH 076b06e6a65c9b7cca5a61be0cd82165
SHA256 cf2afee6c1871706deb922c7105c9e5bf6a2bbaca312b1b4ec4951dcfa033ea7
MD5 efeb7d261da3f778abf002c69a971eb8
SHA1 f4e570bf56015da2c76faac8dc8f28a7e3a3d8a3
SHA512 5cbcd6b9b06f63019e9c00e47e4bee071079e81792ea8cd6173d4f544c15b852090f38e3a642dbc51dd357068634a4b769098204f9f409119a3675eb4d98487e
SSDEEP 24576:sw5i21T5xhInKT/Y2ol8tdi817TWdg0F7RR:sV017TWSyR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:0e:1f:c6:15:85:50:26:fb:33:81:d7:c8:69:4d:3f:f2:cb:21:cd:e8:f9:d2:74:98:a6:0c:25:9e:55:fc:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Coypus,O=Coypus,L=Berlin,C=DE

Chains

Oct 14, 2024

PE Signature issue

Digest

a7:31:f7:40:29:ed:22:68:79:3e:a9:fc:e8:ad:1e:27:28:1e:d5:97

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Coypus,O=Coypus,L=Berlin,C=DE

Chains

Oct 14, 2024

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetModuleFileNameA GetCurrentProcess CopyFileA GetFileSize ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrlenA lstrcpynA ExpandEnvironmentStringsA SetEnvironmentVariableA GetFullPathNameA CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GlobalLock GetDiskFreeSpaceA GlobalUnlock GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Overaction.fri

SHA256 7d5b82bf27f4ff83eefb0176690cd75b3a6ede0706b1fcaa2cf13ac8c6fa2719
MD5 93794b31a8aa2bdab8ddb41cdae2d052
SHA1 bc81123501e291a0863f4e40d2235ae040ae1b02
SHA512 b2b8fcc1243a95de1fbc892ec3e05fbfc8b2e41b51d6eb79b27f6f90818909b431738ebd65bedc57b9d30569fe220e1a1390660d356cd5074dbf73fea74d6795
SSDEEP 6144:lO2wzBMJHN7BVNilaoN2rzBvYQZTrXjY28LIipD+z/tmXr2Wq92nD0VZdk2:b9BrrlYQBrzY1IqW/nWqssk2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Umbrian/Lysekronernes.Itm

SHA256 3e538e27d777e88348085b0354f6c9f3d9330873258e462287031065a105cc32
MD5 c4c72ce894dce7365c32a51106d6eb4c
SHA1 9a328bec9e9c08daa65122ab4b8bbb04af1bb376
SHA512 02d826b3067a65afd50e32482d238aac85021a8d58dc8cd2f5782a4a7dccb79a2576a356667d3c1e00f69b9bbfb1ab4a89f9ccab5b217044855233b40daad09f
SSDEEP 1536:oCRdIhzmP8AS0bFLM6P5rgbJx2lmoOIERF0Fvr:omIhiO0bFwQ5rgbal/KRiFT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Umbrian/alang.txt

SHA256 606e89698f15ab4ae6d85c9305e7d97c3cbdc7b6ed5ff565ff0d8ef952387506
MD5 9ac538831b50dd762ac709015282c865
SHA1 6ab365a6ed01653cd5c4234dded41c44a78ff1f6
SHA512 37f1ec35e388061568efccb8fa2e9889bbd0dbb55c14a3aa44e3ec4550d37658a590c8f414bbe59e2f2bdd09a2a78aff606525f7ae2172ecdf448e877cbb4bf6
MD5 SHA1 SHA512

NSIS installer

installer

Umbrian/anodize.tab

SHA256 0c4938a960eef0da29ba860acb34ff8d644d8ecfa9fa66980cc451324976308b
MD5 935dc5dc7871b03a81341ae7314db25a
SHA1 0bd6adfb528eeb39f2f6ceb7643ff3d4d8a98396
SHA512 645e92ce9bafdb11a8b831abfb4762c08bc8e98bdf841b01432a2cfde84543e0a095a6461a9294dbc495c7ab47e6267655f567065facc2a4139a4a85e2f1ddaf
SSDEEP 768:M22qTV8rh/N86hPvb11iZlpEDf5SjMWYcvsBCAUrsSphV2lLLChInGXdaogxgWax:GdcU7Irs7LGXfovE9yy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Umbrian/eppes.bos

SHA256 54c1f9b6f5111c43a386c54337bcd30516352bab170e976955761ba3b75f7cdd
MD5 36a4a491f19a90c01dfa6c517994c1f8
SHA1 cf2bd67f2aa4ae00bfd41d8c772a2ec08248fe53
SHA512 5dc753610606cbaf5c3ed48b42de3494a8915a45e90a4a4dd5578c7b931f81b05aa43b1befe8cc9bd473ddcc29b03a789f7a67f99995eda44225afe8a2c274a4
SSDEEP 768:ugUmIKbpHY+jAufwfMRcBD1kUZuOhZ23E+um4NzkNY1tq9KN8GBCm+Wrtkz6PLXL:ugdNHY+8Tuim4S8kWtI5rqMB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Umbrian/evindeliges.dyk

SHA256 cb0b5e34c932b5325901bf6754a250fbd794359b1b561c55fb73f8c779c55804
MD5 64684dfd2abbe8a543a3bb3b4e68d889
SHA1 9289aed5b979de48b493ed92efe7594c3919501d
SHA512 0de366ed1dbe73e66334611e81fc1270ba57acc13fa8555b0080f4a810608d9886f45a1192af11c921070fd685004a74addbc6d664dacd4eb4968d01349d612f
SSDEEP 768:XIRKVgsKBIZXhww2DJ3qxZ6vFfi+fj8ChdP09TKIVNXkKE9a8T2PUv5aRyhu81ay:guFKBMlADYNPyH0HXw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Umbrian/interpoleres.veb

SHA256 83de090f885d4a437f71534b92480a024c15880db5392f8a0b2ed873be0021a1
MD5 ef61d88e91a63c230e4b905840b12904
SHA1 b84f85e56511c570ed3aabe714dd2989b6b316de
SHA512 9dd07f5ad1a2526a645ce5f489cfd3750375cda6fbeb4f57234aa9bb977a99727c1de084f7c91b3c2572bc9a2b1752a173b1c67937f8bb1bc21fbb9b9a70ab63
SSDEEP 768:MP38uWf6fMQXIokP8gsdawqMZT9m2jwd3rVDpLGcBNqnEdVEy64Y5A2FrlimkASI:MP5PTtRZg5dRVd0kx4xF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

cf2afee6c1871706deb922c7105c9e5bf6a2bbaca312b1b4ec4951dcfa033ea7.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Overaction.fri

Umbrian/Lysekronernes.Itm

Umbrian/alang.txt

Umbrian/anodize.tab

Umbrian/eppes.bos

Umbrian/evindeliges.dyk

Umbrian/interpoleres.veb

Sharing

General

Malware Config

Signatures

File Explorer

cf2afee6c1871706deb922c7105c9e5bf6a2bbaca312b1b4ec4951dcfa033ea7.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Overaction.fri

Umbrian/Lysekronernes.Itm

Umbrian/alang.txt

Umbrian/anodize.tab

Umbrian/eppes.bos

Umbrian/evindeliges.dyk

Umbrian/interpoleres.veb