4183d5786fe2a0e4563c5a0cf57d92f6.bin
- SHA256 f3417f98d7feb3902bd789aabbb47155800665e5b5009c8941eab4f986255648
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4183d5786fe2a0e4563c5a0cf57d92f6.bin
- Size 527KB
- Sample241024-bpqq9azfqq
- SHA256 f3417f98d7feb3902bd789aabbb47155800665e5b5009c8941eab4f986255648
- MD5 a349328e6cdfeb212a2505eec4a572e5
- SHA1 668014cb8157387ab35fe9ccb952bb39c805a5c9
- SHA512 c75484e40b20c37936b7e29ad6033b4143b800562009fe6d570a71c036ca7587254ab16908f7b0aa9e760f3cd5bed576b28dc9eaf568bd875e2b080589fc8ac8
- SSDEEP 12288:0XhMCs4fj8cl3OVAARetiViD+pZR5p++XGCo3UsVfuhtSf/xuq91i2wR:067qj8cBOVAdtMB95w+Ho3Xnf9x6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe nsis_installer_1 static1/unpack001/d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe nsis_installer_2
File Explorer
-
4183d5786fe2a0e4563c5a0cf57d92f6.bin.zip 527KB
-
d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe.exe 539KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Believe.inc68KB
-
Dumsmarte/Emneomraader.beb480KB
-
Dumsmarte/Generation.txt633B
-
Dumsmarte/cuttlefish.kic7KB
-
Sortbrshandlernes.Rak222KB
-
Unbishoply.Vir440KB
d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400.exe
- IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
- SHA256 d7439af0827a632fe9730a7dd2585a2fb5b0af71c312cdeb49e6a738a9133400
- MD5 4183d5786fe2a0e4563c5a0cf57d92f6
- SHA1 2fc414de34b92a56712c6684c84af970037b81f5
- SHA512 8d86235c4d4060d656a1a2349a43e7ddfc9d036d476dbf8b9d404af060b754eb33bdc74ee03881f769fd19a60b87daefc696e48ee33f40b1e24f358dfe9a87fc
- SSDEEP 12288:DMq47lWuTq/3dOxotjTps+ZHmkHN3HiPCpfBVxe:I/WuTsoWt1HnHpHiwVI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12555
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
SetFileAttributesA
lstrcmpiA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetCommandLineA
GetTempPathA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
- MD5 cf85183b87314359488b850f9e97a698
- SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
- SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
- SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
9922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
835B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Believe.inc
- SHA256 86a20f66e506879de69a2e354d00572755f12b7eecfab9131570def24e77f082
- MD5 c5877563068b66eafce98648af993c1b
- SHA1 06315d839e29aa292ef2a068fa7c8e20b2a35ca0
- SHA512 adc70f868d1f0c4c444f5628473e4bdd23ae4b86b98214935a7a4c74d7af396be2c5d570a91c7f4cb551878e1b3553e78708ea9d610c43aedc15ccb7ee48641a
- SSDEEP 768:s1zMhPtg6mOkvjM2z3rtb8+KZ4slqGrEaNR305W+IK/+UhSON/o2Yy6g:rhVgvZW+KZ4APGbB+4V6g
- MD5 SHA1 SHA512 SSDEEP
Dumsmarte/Emneomraader.beb
- SHA256 7d706e9392170b31b727d738837ada33d8d906973924001a7e0fbc68dbd85ee6
- MD5 d74d978a711f0778c54fe633ae4902e9
- SHA1 96b73d5c015eba38c8828067d68b77d4222b0389
- SHA512 992b19ac31190b3bfeb3180d825c209bf50d22955b820853a8ec08b93147c4542c38b4d2dcf0bba3fdd655420e31f3bfdbcc2c03f64d8a7cb2a42d27850fe3f6
- SSDEEP 3072:usirg+IsO9uIz+Bg/oMenPgp/t0RUuE1NC5X7eBMVRva5lqeh/f8i0Q:usiJIhuNgUY/09XiBMba5lbZfR0
- MD5 SHA1 SHA512 SSDEEP
Dumsmarte/Generation.txt
- SHA256 21a9305bda1cf9f1e1f9ecc7116da6aa84dcdaa7165caf488bc64f3e55820d8f
- MD5 ce9bdf77607e519d876ae31a6cb2812c
- SHA1 aed23a2b0b2c07e4914854e79b504fc454fd550a
- SHA512 1b5914b42afe04061fdbaf318713c614fa9682d58d71905f35292fd716f27b123a9a18656d99f7292495c67806c16b4899e8758fc8f81e6e97573979682099d7
- MD5 SHA1 SHA512
Dumsmarte/cuttlefish.kic
- SHA256 40c15d6718f1313730993407d7995e2813a98726b8451ccdff578ddf040401f0
- MD5 64c019efee01ac4c46f8c827a7d954ac
- SHA1 3cfa56b1d6f7f106234852f23335f7cd99333702
- SHA512 2c6baa03e40825ec1bb85b3951a17ffc86fd7f714df9598ee42cfdff24adba5ba1a81dd7297de7f4693949631f96bd07938b7349782bd0bd2419e6e9cfb31e2a
- SSDEEP 96:8kJtW1Hi2zDyuCmzPWfKDKfnJTOE9XxTcIVKlV:HKC2fyDyQKDK/hOE9XBOV
- MD5 SHA1 SHA512 SSDEEP
Sortbrshandlernes.Rak
- SHA256 8b79faecc74e66945d6ac7a1c40dc0236fdab5f08b36528ceda376e950c50271
- MD5 42896ddf407716ed2b000ede41a70860
- SHA1 5168fa35b55413644ea5b739b73128126a8eb745
- SHA512 60c94c31294b6eb1cbfee9435291b08d6c5f94404ea1538688e96159a26c30a4641e7cfbb495fbb756ebf80f193e4568af0033856d5a2df250cb9c68de54ee6e
- SSDEEP 6144:G+A6cd81ZxFJ/ZiggOcPuJYmhoFRAy8r3HB:FPci1DFJsbOc2emhyJ8jh
- MD5 SHA1 SHA512 SSDEEP
Unbishoply.Vir
- SHA256 8192fecdaee9ffe87fc47e0d5351cbdeddeff85834481080425b8db0718362df
- MD5 d428e8566cdb3615eb3a365b93c8f25a
- SHA1 44698aac3dd7b0a64deaaad79071461e97c724bc
- SHA512 28899f84829048b5457bf37c1341bd119dcc60c9a7a4d247fa9c08d9e4fbbc11ff93bbab3a63f385e5a780b1f6fe7baa86278139bf8024f77cd3698d44eed296
- SSDEEP 1536:jAKYeRT43JgAmSHllDPzwr7ZqeRfNmV7zA0LTHn4X7/tR45UqTjtpHVruaOhDJ1O:j66LdURFTaidryiXI+JAQQmNV
- MD5 SHA1 SHA512 SSDEEP