7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d[.]exe

resource
7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d
MD5 5b9520cdce201fecd22a108edc4b9927
SHA1 6afb7c1ee328ec47ff4aabe5a19cd2d26ab54c1f
SHA512 73e30d7e7f6519216f96638b025f4ce844c11ee90176bb4c49a0923b63423b246f22638db2c5bf61d7c874203edabdd7d4fdd0c651bfdf7b17311278fc67d750
SSDEEP 12288:l0g77CaJ/85VedbvaOvTks8Eac9Q7RS3iDpDUJMDVb8hAvaiKz4R39HzIluzTB:PCm85VwaOLkTjcGciDUJ2bsV21IAJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Blacksnake.Pai

SHA256 3363bc3e0ede61d35a54f3234c8e9d11018c63107dafa6a57aa386080ef9b7ed
MD5 b74a9ebe8647466115dc00a1f3e4c1a5
SHA1 357fc330c1940be9cc61e0fe19555f5be35ff0e5
SHA512 25138822489de4d1dd440a6135171d7f8cafed42f5d7c42ca816d582deba6ffe776b39b799a7068c245c0394e0e61b2e9fea24e36246ecef2892c30113134133
SSDEEP 3072:X1XpVHy+yuKpQo7yDYExHJsloTS5QmZemOCohTJLZ:lXPHy+yuKpR7KzjsGS5Qm8mOph1LZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Drivende130.fri

SHA256 ec7f7d3fd1e3f19d7eb179930bca8118d7cc22e9354f3af4c0188e2c7fcfe269
MD5 eac592fdef4ff6061309c94229f65d9b
SHA1 341d42ba53a82d67734fb478ead1780e3b26f9f5
SHA512 f7d80dfb0f16c07cc314ce20591b4a04651f276299e062ea3c3fd27ac8b437b2ff0f92fa309f7bd22b0dee3559f148f5c63ca3c3ca1146232c831e7f053b21f9
SSDEEP 768:oULY52vNngqmY9lwYSC+fP7c2sMg7QoI0LEpNubnuYQKIT9RQl0crz+qd20fiXfg:5MWlSioXKSu0aq7EOQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Teaboy.kvo

SHA256 a6a794c514346d9fe360e1fc4971ce75036eb35664c0ba7239ba6659c54b822d
MD5 acb3dac027e7d8a81e75845997cee995
SHA1 b44662d87f8c02ad3024ca24fe216b071eb089ae
SHA512 ebead1ae81ba391b0e216db544c747a229b66c8fc21535be531e3603fd526f290374d9cbf5b2a86cb8ca6bdb39bbef8d4b4685ef8204b63026ab1b41bbf716ab
SSDEEP 768:Cs6/fpeiKq8XuZt7p9KiOHB1oBPZLDX6rg53F6pg55+P1kkd2iv6SBG/JTu2PMWw:+/1Hz0idZLxwPd85PNgwXz2kM7hDE2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

arbejdslejre.txt

SHA256 a072ea92f5b60c3b585e742823a482461fd1f4100417e858b7b14cb352b3ae03
MD5 8a9a9da45e1af070a4bd0c6fea028572
SHA1 14a41b1ebc6499026f10a1f419b349f6fd0d1b10
SHA512 63940e24e98f3a07bd06933aa8ff6f780ae20626e71184e4f4368e4faef6ed7261b2eafdc6cd83bb0ba1f4ca2853561a2b40135505653bfccbc15879c5a9671e
MD5 SHA1 SHA512

NSIS installer

installer

baronesses.hjt

SHA256 b6e609d3ce8f92f28df7eaa49b76cd38d8b78e3da064e8e642af116947918135
MD5 a4ec2cdbd69c8ed4040a14939d819548
SHA1 1749325678fde89506b68f05eda9f333e52e3ec6
SHA512 3e3f1e353a0b3c741f9c24891013c4d373ef4cb1be1100a1e8911a4eab53d053aaf3b6f8e82213f4128459e773a3a876c20c7305d349c42259d2c634ff74063a
SSDEEP 1536:DBmnDpIR0NXBZG7QREpBzWhXbGN4Ip3zC:tsIR0LZG7QR2BzyG42jC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

foldage.ins

SHA256 e1fa048e56ae80e8518fd5756cf6f34c61a42397b94e032800b9a69d735bed00
MD5 5d25bc669aaad6f2df194d8e2bbbb219
SHA1 3850a45647d056903fdef8c6980ba47b1eaaf3be
SHA512 21e721a292f08b455214b469efcc853bf4efdeceb34661cd30e3cc17bd5bca08e26f505b4416eefbdb4e9b3912e15fcd23c2e70b2248835f43c25b18e2624898
SSDEEP 768:C1ZC8znZGYaZJR+Pym4zIFQ0oEVd0g49mfL6vZIhPrw3S+3ylfcyFQ4oD0OCH9FQ:IZjP4zydtw+hPw7yHjvkLDgGSMc7Jo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

genindkaldelsernes.lac

SHA256 80fda08258b48efa07f727b9a4d5074e4f830cbc66f8cacbf2a8343610b94021
MD5 fdf7f64d75ea53ac73a4199b794b9590
SHA1 c42ff28dd8ba591a641607419f0e691f816f5cf2
SHA512 a02a4168d1aa15cba61e3c67a21af3b1bff7bf2cf4e639a3cfc166e12a22fdbffcce292b8be8a5f6a5880c4e08113f7dffd61455979fb74e259d46c1331fb2df
SSDEEP 768:icmPKbjffXQCQ2EVaUM39UdxcuF0kWeUtq/YD5meIB2exoVNHIFuQrVOBaMDXbLp:iObUCdKcxgkBe0z9+MRMI5zlbl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

mutches.ind

SHA256 f993410df7a0d0555cf7ca8951f5cdaf07419e3fa254a072721294ff905b8751
MD5 a81c5ba7378f37c4f5acb8564c350a2e
SHA1 8924753c3db7b984c5acc4eff3db6157ba02cbb8
SHA512 79a2880a4f684d5ca4fb5a0ef91b263d302a20c09e643a83570d0fb02193d4f930ead430b7270e468a832d7bbb7792023dfd360e1bbdc45c0a0c27be9bee0645
SSDEEP 768:WD9KTE3w7RtUqnPubZ/OItKsCz6Q+ovguVld6wHCgSIVf/rbezb0+N6wDNBQdBZI:BMEPu6WNovVCtWRpxM5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

toupzrer.dou

SHA256 50055717d5f455ac119d598450f095bca81b5ae65a2d21b53843f31f1345379f
MD5 d9212aea20b1deee2da8da56313d0691
SHA1 dc026413a983ce244681855ddebb39727379d426
SHA512 a62aa29fefc2b626045de4f885ac8f6d76a72e0cd7db5f26a6b7136aaac6bc9fbb7533f34e2708e895b137c1ec077307a93b5c0376dc7b9039f7e32bc3587e24
SSDEEP 6144:DINJywtOdltrmE49sPjexQvnzqnzRE339SROXkuY:wJtYdlta0ax2WRE9Z5Y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blacksnake.Pai

Drivende130.fri

Teaboy.kvo

arbejdslejre.txt

baronesses.hjt

foldage.ins

genindkaldelsernes.lac

mutches.ind

toupzrer.dou

Sharing

General

Malware Config

Signatures

File Explorer

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Blacksnake.Pai

Drivende130.fri

Teaboy.kvo

arbejdslejre.txt

baronesses.hjt

foldage.ins

genindkaldelsernes.lac

mutches.ind

toupzrer.dou