8126f3d67e43f2c93f178b68cc6a791a61c7f4f986cd5fb0d213780c4aa8e2d4[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

8126f3d67e43f2c93f178b68cc6a791a61c7f4f986cd5fb0d213780c4aa8e2d4.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 8126f3d67e43f2c93f178b68cc6a791a61c7f4f986cd5fb0d213780c4aa8e2d4
MD5 8f4adfd3b8c55670a99389ba3905e43d
SHA1 24e4a66a55b65fe58933ac92b161befc5c5df977
SHA512 9ddc6fb7d8f92d4ad22e1842704dfd8cad0184f86c9482fb2cbc051008a46bb87449c8abba66b4179fc602978c31ea9215cd070c7008e39f71b6d24a43c3c527
SSDEEP 12288:d93jliesAP5dtwQYYy016wq2FFbyADqbM5LugDkzicmrdZNf:d93jliR4jasy01DHn+AWYROicudZNf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

71:36:a1:1b:e3:18:46:3c:dd:9b:b8:62:b2:58:3c:91:d7:fa:fc:39:e8:7a:da:80:23:33:2f:e8:2c:f2:23:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Partils,OU=Breastplate Candlewicks Miljforbrydelsens\ ,O=Partils,L=Paris 02,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c2054746865647366756e6b74696f6e65726e6540626174696b66617276652e466f

Chains

Dec 12, 2024

Minor OS version

0

Major OS version

4

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Deinos253/Ekstensives.Bnd

SHA256 0e4b16fa84ad77589a294a9a4d9bfd243eeccf6a2be6975e2122b3537a7e1cf6
MD5 c218052ab259497819cfe121db3e7483
SHA1 ff3d7204dd2d9aa1a590132db4e347d2db7af7c3
SHA512 73704852648a92e92ee0be371c463f6c4ba41c15f1e043e5b43d7c1d55771b64488a15bcf9f3a2316a5d2746908b75dd542d417d935660ab5694c97f38027af9
SSDEEP 1536:mE+A9CauLBT0eX1ckLgXDyn6RK0Tk4f7J:mE+A9CjLBT0C2kce2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Deinos253/Udfring53.lev

SHA256 9091fb5a1b166d03c61848505a440e8b33aca701de691d7e4eb8fbfe7379fcaf
MD5 b4834640df9710a3741e667024766f83
SHA1 b392e116f95a0388b7d82c7bd453fd4b3aabe9b6
SHA512 76396f26f236de394ee3c2441073bf59107f61393e87d730cc70e989582361aacdaea20e59ea49cc0f125fa6a8405823b17a5d24ec111391e83647fc3687f48c
SSDEEP 768:soeSIeBIi+CIHPx0zCnX4uXSmBKjtdYKffNFYu5bA+KNiyvYFxUT:G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Deinos253/Ungallantness.kok

SHA256 9f10026e2214ca3c9c59a9af9913c2ef9c01ac32efb3a7db3a2bec568809904c
MD5 5acf4982dbf490ad4ae83c7d1856e89c
SHA1 66fe8a2b3323ed8cf74fbf6c681d0aa3496a6185
SHA512 b1bfb5a4fa9b1b7841254161f9347adc44e3269d13ab7e703a2ec009b95844442e66312436835185e7779673c2e5553659bd85f4b141e5cf907eee9198ec1f82
SSDEEP 768:nHrNCx0tE2B2CS9/Nq7r2Cr5WHOKjzQT:rt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Deinos253/Uplejedes.Ile

SHA256 bfd1a80e5fb97d60cf6aea256ef9a178406f557b413ce561084f8535d02cd6d2
MD5 0b6f4d48e7517e011d43644f2f7f6f14
SHA1 c97bf2f3fb0617a951e2d1757e086f642bbd7cb7
SHA512 b419289eb4e56556a9c2f0c2abf7574f9cb811eadc772e33548cec8d7d76708ee01bd32dbe63ddc5719d3f070fd54457317c3dc4ad9b46d094f20197c7b6545c
SSDEEP 6144:gkhngsOoUfdBkYM1UE+mE1/jBSq982t7r14zSMV3KqgLbhr340Pf:gongzzfdmYMKE+bjIR2tKz5UqgLbXf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Deinos253/Yaply50.txt

SHA256 e58319c2fcc8c30c70969bed761493afd5b7f29d12fdbd1d96c0bbd93efc6db2
MD5 c271d6423649c301105c8a2eca25f9e4
SHA1 cfac3739c43482547d096c88670fa646fb62a56c
SHA512 b04bbdba8afb3d93d6e10c9ea838ec3b2d3798cb0f8c383c44329fa35b4f6e72b4023fb1a6adafe49af258cd876a5bb0a019c742353936eb6c60601937eaf04d
MD5 SHA1 SHA512

NSIS installer

installer

Deinos253/rancheria.pro

SHA256 1b795733ffc880d3decd0a23bd3ccb22ac6a80eea5729d407336d891f0523884
MD5 b34fc802327d0f5f02281fd236bd67c6
SHA1 e7e1e1e5288f16b42fb8b5a62c9b33a4b8d02341
SHA512 dd170f304175543b07eabe1f09d0548dbe9c332074a0493d1bc4400494356104e16d47c684eb04a04447283427612b1eae5c40bbb42e087f77fe72c841b9db7b
SSDEEP 768:oASe3amtYNbHv0lnDzgcAUOkEuypx/zSFad:
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

8126f3d67e43f2c93f178b68cc6a791a61c7f4f986cd5fb0d213780c4aa8e2d4.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Deinos253/Ekstensives.Bnd

Deinos253/Udfring53.lev

Deinos253/Ungallantness.kok

Deinos253/Uplejedes.Ile

Deinos253/Yaply50.txt

Deinos253/rancheria.pro

Sharing

General

Malware Config

Signatures

File Explorer

8126f3d67e43f2c93f178b68cc6a791a61c7f4f986cd5fb0d213780c4aa8e2d4.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Deinos253/Ekstensives.Bnd

Deinos253/Udfring53.lev

Deinos253/Ungallantness.kok

Deinos253/Uplejedes.Ile

Deinos253/Yaply50.txt

Deinos253/rancheria.pro