fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b[.]exe

resource
fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b
MD5 d6d14fc73f7e485b864a1dc1d8fde8f9
SHA1 85a6480abc0f54dafff5e4bc2b996e7655f91b2b
SHA512 00a35cbb44902a58349995ac90800a935df7d28e5e81f3fbd786375be29d7b8dbfb974849046590c0f98702c6f21dbca7a40b5130aca80d84a9c44ee0374061c
SSDEEP 12288:m4OpVuMv6/eGOFqi0isX8G2WJHkQ50g/s2QkPICHYA1U+IauB:/g/0yqiwv0f2SCHYAC+I9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Flaaende/Afsagde/askebgres.law

SHA256 caa6dd94ff7fbda07250b33761089203d8e505aea36d8edab74461f8a7da0e3b
MD5 0201ac85fdfd16658c9aa049c60a0cfb
SHA1 88aea24fa3d1f01526bbaa02c3432401ba906aaa
SHA512 d9bf8e9f1f2d15c81dfad42ad1d84613ea80c1d158042198d71c62458e38b7e1cc0a9d9e3ae0108a3446358eb9ed341eafd4de1ecedb839876c6e1391e3db68c
SSDEEP 1536:rt3d47HMBO7JlO8vzckElHYEjV4HqSakiYyYAqFZf5YB:rtdEsQ68v5YY0fiyYhRa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flaaende/Afsagde/dumpningsskibes.sig

SHA256 c83ceda2b44ed61f90fbf4d629170f5ad15bc640fdaaedc8c4196d9648473367
MD5 2d684eefda41a257d4bc90b3e270a11e
SHA1 7e9f2db513585fae6273e8d2bdd3da1b72bab088
SHA512 d7e33655bc8272704078cd7993c8128ff43e2d336ccbb6387102ce2c1aef7cf8952d04adfee5be37232cea50b48b033fea73e4157634c38e3e11a354891b89de
SSDEEP 768:C+4dMjT0QHgwDRJ4ITussQrJAh/09jbuJk2rFA13aa5rPzX4evP43r7zgbWI9Zgt:xLF3TusTM0BbuEFzXgSM9E6Vn/hqCwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flaaende/Afsagde/phaeophytin.cam

SHA256 9639e2590b96fa3d440c7d73dda4a5ecbe84a5110dc829e3ec19e564b01aad88
MD5 abf5ad4a689f07948e696c710ddd2529
SHA1 8c073756fb12457aeebc91354cc06de553956cd7
SHA512 a7d063a83f6459d86cfef0d9f9b8508b007cc799b65fc6e107574f4476a93474b8bf8960df6068e165f9bb265e41cbdb659a3e0d212c8baeec38bab148044489
SSDEEP 1536:sFammnV6Iq1EFNURNG9A52MaGMqTKM51llPRqsjWG0ab:sFamUV62LcNr26h9pqsjWa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flaaende/Beauish133.Und

SHA256 e1ddff2555c2b7d0e941f6ac42788cea89bef9faf32101b8eb1f7f1c059740c8
MD5 b92ef2ed955693af5727962bc0cf7cbc
SHA1 ad4136a289079737181bb29f4b2ec9144d70a0cc
SHA512 82494fe3f99fec0cd8275524c43caf95651c043327a5dfbf43dcc6e2ce2b3acf0c5e8909f75538281ed8840154652dde8b2970e6da7478573346671a33735f38
SSDEEP 1536:GttQUfqbwzFBPs3TfwmG7VPw2m2IJ08xwyefoUDXwlTN+:eu4iwzfsEmMFw2uG8xw6UDEQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flaaende/Overes.txt

SHA256 0b2100254320f7f50aa354831b450038555da8ede41ce55a24825d854498b651
MD5 a3c04d089bf015f9cd3c602fe111bc3b
SHA1 82f4f0007b9d8d1906042f8f09b07644c6a58ff6
SHA512 9a8c2ccc3c49ad9b9fc9c490c4baa4f9865578bc2aa7ad5c36ea5d778539b4577e74e76f4dfa4f06de08965ee4e30bee301fbef4e5f5b03487a9e1055a63f5b8
MD5 SHA1 SHA512

NSIS installer

installer

Flaaende/Trstprmie69.unj

SHA256 bccd02c6c50c303a8d0f610629ab81a7c96848207e214323a01e66726c71d5f6
MD5 283c9c5ec924d80557bc40d007c57164
SHA1 6c259e0a4830b9cf036c8f139c66d291e7bf0fc8
SHA512 b8442365a7328f0733a77a6f43f64ca9a51843e45c659604bafad3ea0016830d6c6da09b37ec7c04ccabb854c21674f7a35ea04fa5a295aef74200763f4cc3d9
SSDEEP 768:fDnRf9/3miTP3cpz/OGoqBE8CUSTP1X7vqTFecysG57NtiPHc/Tg5LLFOMKHi031:79jlXsl6a2vTW0opiY7lW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unviolently.Sel

SHA256 5933e701ec0e863aadaf60d9549ea4c16bd301672e7a55d9bb3d43384f10f2ae
MD5 037e8f46a76aa5ab59350beaf7be86c8
SHA1 dd4036c1dd0dc97148f0ea0a14c1492ccb6c4f30
SHA512 f58706e6a4cd00b5284eda180fb06ddaf63a1e72c887e6bc1664e59669374be462006deca85c649f5be1b8dd292ef31c560052bce670e0122276e07e0ec22ca7
SSDEEP 6144:2xMi32o1Mmpm3idnQztl0ORt5jXE+b1ISNOtWKw9qQdU:Qf302nQBlfRvjU+b1ccKQnU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Flaaende/Afsagde/askebgres.law

Flaaende/Afsagde/dumpningsskibes.sig

Flaaende/Afsagde/phaeophytin.cam

Flaaende/Beauish133.Und

Flaaende/Overes.txt

Flaaende/Trstprmie69.unj

Unviolently.Sel

Sharing

General

Malware Config

Signatures

File Explorer

fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Flaaende/Afsagde/askebgres.law

Flaaende/Afsagde/dumpningsskibes.sig

Flaaende/Afsagde/phaeophytin.cam

Flaaende/Beauish133.Und

Flaaende/Overes.txt

Flaaende/Trstprmie69.unj

Unviolently.Sel