Lydisolerendes[.]exe

resource
Lydisolerendes.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Lydisolerendes.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 d44e056cef3d42814519f4e2cb0bc609ffe8f1ab02bb49093ab9b04ba349e998
MD5 c102be4fe0f4b2daa8079f8e96d3dbf9
SHA1 621ef9f2ec3b515811554c54fbc1876327ca9039
SHA512 dd1ab1ae628626ffc96ddc71076a70ef673dc22b0a3f10a888a43fec2fd89dba82b7158cc1460cec7753d61d60d40f3ce94d1c1c7c2833a31c4d9aa37f1eaf84
SSDEEP 12288:DML8DpbWc2SiqNxMhG330KXWBtxsqUGy841Wks+ZHmkHN3HiPCpfBVx:ILYtRt0BxTZy84DHnHpHiwV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Believe.inc

SHA256 86a20f66e506879de69a2e354d00572755f12b7eecfab9131570def24e77f082
MD5 c5877563068b66eafce98648af993c1b
SHA1 06315d839e29aa292ef2a068fa7c8e20b2a35ca0
SHA512 adc70f868d1f0c4c444f5628473e4bdd23ae4b86b98214935a7a4c74d7af396be2c5d570a91c7f4cb551878e1b3553e78708ea9d610c43aedc15ccb7ee48641a
SSDEEP 768:s1zMhPtg6mOkvjM2z3rtb8+KZ4slqGrEaNR305W+IK/+UhSON/o2Yy6g:rhVgvZW+KZ4APGbB+4V6g
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Emneomraader.beb

SHA256 7d706e9392170b31b727d738837ada33d8d906973924001a7e0fbc68dbd85ee6
MD5 d74d978a711f0778c54fe633ae4902e9
SHA1 96b73d5c015eba38c8828067d68b77d4222b0389
SHA512 992b19ac31190b3bfeb3180d825c209bf50d22955b820853a8ec08b93147c4542c38b4d2dcf0bba3fdd655420e31f3bfdbcc2c03f64d8a7cb2a42d27850fe3f6
SSDEEP 3072:usirg+IsO9uIz+Bg/oMenPgp/t0RUuE1NC5X7eBMVRva5lqeh/f8i0Q:usiJIhuNgUY/09XiBMba5lbZfR0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Generation.txt

SHA256 21a9305bda1cf9f1e1f9ecc7116da6aa84dcdaa7165caf488bc64f3e55820d8f
MD5 ce9bdf77607e519d876ae31a6cb2812c
SHA1 aed23a2b0b2c07e4914854e79b504fc454fd550a
SHA512 1b5914b42afe04061fdbaf318713c614fa9682d58d71905f35292fd716f27b123a9a18656d99f7292495c67806c16b4899e8758fc8f81e6e97573979682099d7
MD5 SHA1 SHA512

NSIS installer

installer

Skrmskemaers.Her238

SHA256 0cd2c3bffc91f3cf038a6486ec7c2424fdb54d9223df9c75a3e9e98f6e7ecc63
MD5 e3d9c78a918b5f131ca8e192389d410b
SHA1 dda49ab7fff85b2ba9b0554bf4e238fea0658410
SHA512 a8dd3b2a3373b7b340375e23def89dc30ad9719c2abda1fe641668fc37ac68772b58865b817693c7786cea60f16a3b5ac09c14cd7845183c0b55b56c28c874d4
SSDEEP 3072:qBwJk7Y+iyXTLBWzFYw1L2RQLsCDJbYsO5rH940QTEolzEzf9jK0CtkyU9:8wt+dXT96yRQLFJbHO5rH9nQ4olmCM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Udlsnings/cuttlefish.kic

SHA256 40c15d6718f1313730993407d7995e2813a98726b8451ccdff578ddf040401f0
MD5 64c019efee01ac4c46f8c827a7d954ac
SHA1 3cfa56b1d6f7f106234852f23335f7cd99333702
SHA512 2c6baa03e40825ec1bb85b3951a17ffc86fd7f714df9598ee42cfdff24adba5ba1a81dd7297de7f4693949631f96bd07938b7349782bd0bd2419e6e9cfb31e2a
SSDEEP 96:8kJtW1Hi2zDyuCmzPWfKDKfnJTOE9XxTcIVKlV:HKC2fyDyQKDK/hOE9XBOV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

revisionsvilkaarene.Cra

SHA256 aa444447918ab2bd305b32e369983f027d27895860f5ba4383a7c86d17ff8c32
MD5 c32d488d2c3ebb3d159014f632644507
SHA1 55c6e274bb7a6fe4bfd1cbbc8184f151874f75cc
SHA512 7dd4a60c4ccc1208388b1771705575d3235cd6dc7676a5b50732a69fb803f2bbeb3d78389a924b51f7ebd2df8a4ee83279110624ef4bfb4c0abb3074a4be4921
SSDEEP 3072:oQwJ/QvWJFiqwkulDf8GJXWS+gCD8FPI+5vB4CT:jw1Q+JFiqwkulDf8GJXWSkD89I6vWCT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lydisolerendes.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Believe.inc

Emneomraader.beb

Generation.txt

Skrmskemaers.Her238

Udlsnings/cuttlefish.kic

revisionsvilkaarene.Cra

Sharing

General

Malware Config

Signatures

File Explorer

Lydisolerendes.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Believe.inc

Emneomraader.beb

Generation.txt

Skrmskemaers.Her238

Udlsnings/cuttlefish.kic

revisionsvilkaarene.Cra