137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86[.]exe

resource
137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86
MD5 643c1b8444da8c89fa83aed917307b6c
SHA1 dda8fa31873ef7f27e22f712a2e0b6a7ae91a582
SHA512 61636bf0eabf40ef8085a68170339184a73b7a3a528604853a75e577b549240de7a78a1c879757b510a13746184caf678d05e1e77c8c7a9241cbd7c2e2b87def
SSDEEP 12288:2dD2EUL1JUodNF0bzjryAqlBGWcz+izP1niQPqDEfRuLCMrecszC/:wD2EK1JzW3jGxBGDaizPkY6/mMScs2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 d65875bb4bc121f81384d55fde90dd9eb9ad1878cd8a02bcb5c8a933c3987a61
MD5 61f69388ae89d61a3d838cbcf81b4f82
SHA1 e595c0236a373a6ac79c334dc183ee03ca8f8ecd
SHA512 21d34738cc21c1ef6b0ef1ac53659cdab224bbc20ea983f9a952a2cb4b5785a07bb18c0acf22a0d12a94795e1fc6d314f442c923bb1a93b675edac8c6aacf469
SSDEEP 48:im1CEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JCof5dwe:F10pl9NLBAZuYtR0hd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bedsteborgerliges.ska

SHA256 985bf1956478234e4a23dfb5879601343e8cac69da4e52027cbca7ec5aa51332
MD5 4d3aed670f4cd4cf671739d8753cd6d3
SHA1 cdf9f4cbf0813c7c952e6c0e28294e2e6c5fcfb3
SHA512 98daecb274db71e739f7761dd8312a8938504421cb3a23de59437c8ddeb658c297d82063616f7ea04c5ee739c90a498a8c721ec7d8e86f35c05a5b6f839e9944
SSDEEP 768:mdVydb3ofc51+MAc7UTLTU+i6s2xydedCA1+z1R5LzXfgJ+k5Pk+tbAyHQZoAPqS:ma+14wdxEzJzXgnBnwGm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Belgningsbaands.For

SHA256 22ac5506ff0d1b27a44aa9cda179e287bb58996504eb05a3e5758b6fca83f027
MD5 faec942bdfa27b76d9433c6805e8bc8a
SHA1 8af85b7e6b70db50af285454973a8e4d5cb1b05b
SHA512 d24e726daaae5740debd6a143384aa57378fb94bdd4fb06439be012145f6c3abdb8f8205f5c687a456bb074bc7d747b28e88ff02f96e55a1a304ab57609e2c19
SSDEEP 1536:63NDFZJ0yzSSFSP3mcto+RJ+MFXdzdJclgfGe/O5gpy:Mp9N2KMOt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Bundliniers.Wal

SHA256 75b332486d361a9da7efe8835b85ddcc8119e2525eef80f9e4cbd2f532d4918a
MD5 f815125cd4c4d1e70113e7978c6ab753
SHA1 5a988ebc089601c37534803770001aa49949e1d2
SHA512 5ae2f9751767cd43a0836324ea8efdcf5b2569204b03084723a406f338b26c55d9e819f1d510693759b854cd1e59f2bee10da266dc27cb95fe1a3516973d220f
SSDEEP 6144:lTwQh9VnRSCHMln4/os5YNL9qgJgXs+RG4UvKjSYEVPddE9Tcf:lP9YtgXsVvKuFPrOTcf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cellefngslerne/dactylopteridae.arr

SHA256 b690cd825a409ad9a2df4ff48f881592ee6e20ec944459e61feeda083ec8b33a
MD5 5d36fb5fc32d9b57654b7d614af4276c
SHA1 f45346b9c57b886457180a0a838ce9b1d568b8ba
SHA512 55fceef462552cdf21da024eac786c2743f2817dcdcb9ff8bda51b71ab3b8586bd9498fb01e1fce0890b74c1ed569da1ab753ac3b8b0006106985f1e2d540d88
SSDEEP 192:8Uoq3zQFqh0nK2+NH92T16JssBnvezxgmcRkXtP1SUkfz:8KQFs0K2+NHO1DsBnvezxgmcR2h1Sffz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cellefngslerne/kupfernickel.txt

SHA256 d69b6c4c4a4a2855b26951ee8cefa64f80b915de17b686697b82af32b467bbad
MD5 448e02131260218207dc72e34d6af99b
SHA1 166fc591a2137814f1f2e63a555a26ba0eb22136
SHA512 58f15948e03d64bb44c606ff961540c0b8a1c9325a839de4733374673095d4c498d9c678c514eaef4c6a1b00ef5ae4dbb4b0147e6777919787aeabc88e5eedd6
MD5 SHA1 SHA512

NSIS installer

installer

Cellefngslerne/tabtype.mil

SHA256 20c00d941e6ff2066f43632f8f48178e3a8890047fb9097480ebac572c282854
MD5 46c8fa6a82d7917c5931bd82e7f520a5
SHA1 479c2b3798fce07e38aa3eebb198e89d6761347e
SHA512 c8c7b860ded8da1a0487de4792ce7653d95d86e8546a6f375ba8748eb33e79b4aa41bba7be8223f394c5f0f5f93cc114132a8732491af76b2bb6c04e983430df
SSDEEP 1536:mGpJHFZRTfIEdBVSuSnxoxbmrj8GuFkCX66PPUQl0ieAVHDBK:DppL+EUuMQbKIFVqmP/+i1h
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cellefngslerne/vrkstedstids.nri

SHA256 12194de1af8bbc21b2dfa55ccbefb089b11820bf149919398301a515a7d9f539
MD5 5daedb2a984db5b0b5e7043acbea51df
SHA1 f159484d6cc0f5c5fa9ad35c76eba9436a5243bd
SHA512 22c088e47e3e700c6463d758d4f4fdbfc284286a4a3c92b15383313472ecd9aefee697507342796d48b286477f58842ad3fa2239bc1d1d3d8005e5c8ba0a1167
SSDEEP 768:UK4TVspxmqTulB2IaWA4lqbkE2pOhzXD/QLuaZR5/m0mSaXsiwu3tvxHqjG4jgLD:UK4/KWhaIdG4UczgY+oLS0+XpNr9L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

case.jpg

SHA256 722de6404247b0a96bab46c7567661b352f5a8bf2b267e333930c4cad2613868
MD5 f68eeb6cacd594c1a6b662d2cd30ccec
SHA1 fc7ec71bab41e5df5dd6fb5a5105a512c7f74b53
SHA512 792d3ec7d5a112275382cf7b89f4a305cc2f9e4547d2c6329368553e139afdc20e377d197f7ea627d77e003607feb18c8f1343b049f47f9d4db926d29cccea78
SSDEEP 3072:IskG8wJzn5V9qqn0ZLsull85ijr0cBLUufuuspBo:Is8wJzP9qqnsE5ijQ4UquuEo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chinones.nua

SHA256 aad206388c03eac32671db151d2826ae968e98912b17f2945da07205dbe8ce38
MD5 7285ed87bce392319a3d54d811964fad
SHA1 2716195b1d0f5ce8ec4921feaa40a62baafdd7fa
SHA512 c339d48676963210d952073f8caa16ae856341f97cae4c9919a30ea051a45e2d41777a1ee3ea3b813ee2418d65b03704c3c2686cafe4b4601b877d50419d3fb0
SSDEEP 1536:mG/eiR9wzu4ClROIPQQC3VIzpMFuF641GthTKbR:kiR9jtzwmpLmcbR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Belgningsbaands.For

Bundliniers.Wal

Cellefngslerne/dactylopteridae.arr

Cellefngslerne/kupfernickel.txt

Cellefngslerne/tabtype.mil

Cellefngslerne/vrkstedstids.nri

case.jpg

chinones.nua

Sharing

General

Malware Config

Signatures

File Explorer

137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bedsteborgerliges.ska

Belgningsbaands.For

Bundliniers.Wal

Cellefngslerne/dactylopteridae.arr

Cellefngslerne/kupfernickel.txt

Cellefngslerne/tabtype.mil

Cellefngslerne/vrkstedstids.nri

case.jpg

chinones.nua