13012025_1630_13012025_24010-KAPSON.rar
- SHA256 388d5d0116a16b2cf3711107853f8ae3052273ad55770d95ac6c5ca4643d5f47
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
24010-KAPSON.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
24010-KAPSON.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20241023-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 13012025_1630_13012025_24010-KAPSON.rar
- Size 822KB
- Sample250113-tzy5gsyncz
- SHA256 388d5d0116a16b2cf3711107853f8ae3052273ad55770d95ac6c5ca4643d5f47
- MD5 16f45dfbade21c80c8558b25e0c04a0c
- SHA1 92c0f481e55a87e3ef84a259603065b0717fa668
- SHA512 d077c6795f5593e88a0c29406c5119ef8951f13ea58ff75983bb341c430351376e56c88a706fa2fb197a332312dab46f244d58686615095be46cd6fc08a41ee4
- SSDEEP 24576:ikqDTim7ZHCUWihj8vl8k/vgyEaRCuOD9:ipGmZCUphjW8kJhCp
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/nsExec.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/24010-KAPSON.exe nsis_installer_1 static1/unpack001/24010-KAPSON.exe nsis_installer_2
File Explorer
-
13012025_1630_13012025_24010-KAPSON.rar.rar 822KB
-
24010-KAPSON.exe.exe 927KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
Deleaves.Sko74KB
-
Rntgenstraaler118.Sar326KB
-
arrogantly.wea1.5MB
-
brudsikreste.txt455B
-
fistres.pho4.4MB
-
martyrdds.ele2.3MB
-
vagabondage.fis2.1MB
24010-KAPSON.exe
- IMPHASH e160ef8e55bb9d162da4e266afd9eef3
- SHA256 1112d16470efe5c9714789944abe3dd43665d9b1f3a206b5d15406e6ab0ef414
- MD5 21c5e6a566f4f22671bd4933ab0dce66
- SHA1 764dcbf2aaa25271833bfe217594e07bf4bb9e93
- SHA512 ae7d18770a9a12077f33c2657b9ea852dbb4cf11f759be0064046c40866ce1f49f20d32737934b75694ee1e55fe479121ee5434d9d35628c3a0a1cdf12a8648b
- SSDEEP 24576:juA8Xd6qZNpie53Kl6RJNBIQll+hQT2jiux5J:RKdkec0RFIQlluQsxD
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Password
infected
PE Signature issue
Digest
b8:9e:63:2e:db:a0:8e:a6:8c:72:dd:af:91:86:d6:70:a1:b9:2b:d7:e3:d6:5a:e9:6d:17:18:50:36:4b:51:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bavianens,OU=Fryds Myalism prikkerne\ ,O=Bavianens,L=Lyon,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c124461746f6c7973657340546f796f2e44686f
Chains
Jan 9, 2025
Subject
CN=Bavianens,OU=Fryds Myalism prikkerne\ ,O=Bavianens,L=Lyon,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c124461746f6c7973657340546f796f2e44686f
Serial Number
1b:47:ae:bd:ff:34:8a:bf:a4:35:bb:dc:4a:57:8b:3c:eb:ed:49:94
Issuer
CN=Bavianens,OU=Fryds Myalism prikkerne\ ,O=Bavianens,L=Lyon,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c124461746f6c7973657340546f796f2e44686f
Timespan
Oct 4, 2024 - Oct 4, 2025
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/nsExec.dll
- IMPHASH 6b7d154c806f1e47db325229c300c6df
- SHA256 cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f
- MD5 51e63a9c5d6d230ef1c421b2eccd45dc
- SHA1 c499cdad5c613d71ed3f7e93360f1bbc5748c45d
- SHA512 c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522
- SSDEEP 96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GlobalLock
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GetVersionExA
lstrcatA
user32
SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
458B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Deleaves.Sko
- SHA256 07425814d63de0cc304ecb7a7722d35eaa2db0844388112df43c284b89fb4e09
- MD5 4f6a4d9161aa1dd1ea0a44a1e6c788fe
- SHA1 c17ee8277755bb04e4c477521d9fd70f9e3f9e21
- SHA512 e5272f9417eceb11ad256801e3380c53dc4fe17b886afb35456a22a30dc6cf5dc7bb64e8f69958577546c1bd14d88377fa4e9c52d63b07c4ddb999dd99cf7214
- SSDEEP 1536:so0MqJKwyS1garSNqs96B7/j0XMoD0+dpH/RgFxD0OjMtlAHSAz:1qLGaYqz/j2ffuFxljelAHSAz
- MD5 SHA1 SHA512 SSDEEP
Rntgenstraaler118.Sar
- SHA256 89216dce9377273dc3a275c707d7b8000aca2432d612e5bb0f3bdf01685542c3
- MD5 c49331cc8c53164ccf069bace58eff38
- SHA1 46b8451d105e7978ccd27313fdaca86c2a5e3e1e
- SHA512 baf34acb5786134d759954c2ef4445484c605212be3f83956aaff6895b8ce8cbf8e587e6939fcd474d3ce8d0242f9f564290a0640b0ea8558693800606acd855
- SSDEEP 6144:utGZPa8zg6LzyXVWFyAbfK3d0p9xQoIDPdG9lTzha1gx4o42:G+gHF4rbfWIWFG9xzo1gt42
- MD5 SHA1 SHA512 SSDEEP
arrogantly.wea
- SHA256 3f08eb75471c7749cf2832874dfe9d87d7c92f6c0b287f44c61ba87132dbb6b5
- MD5 b12744c545f373b12899405e7b06703c
- SHA1 00444a0c0ed55b4bcbd428e9367c48b943e6b6e5
- SHA512 356bc941e6d7e77bbc6809c2e8b7835daf26a649478fad3bbf96cc0ff5f7ac5380433a7bdf1706778e2e3ad60932e91c3fcfd6a2d161f25a19626396bfb7f2c7
- SSDEEP 768:ASVaka6XCOUX+4bFIT0hio6OHaHuPqo8MObUS8wQ9x2q0gQIsH9f9aoDpvfPUGRM:TLDlBdK
- MD5 SHA1 SHA512 SSDEEP
brudsikreste.txt
- SHA256 fa8a7d0fad17facb47c04904463406343d46e9e4a6932231f64ee2bcd8562c36
- MD5 c66131be12e218cb451a5cdefefd93ef
- SHA1 5d3efe4f715281097ac9ef67580349088d89d858
- SHA512 3f71b278bb06786af7422846520bfcdadaf5d7fd64a1ab3023210fa7a82b1fd3c18e504ddec18b5ce7f931a966c30c1738234592a51b59ab79bea69d24c998ed
- MD5 SHA1 SHA512
fistres.pho
- SHA256 b146d608f302e262857711b5e9a9b0fd4409e952a025854f36b9e2d9325e0fce
- MD5 5a6329442d47f58811e3d0ab09312866
- SHA1 d84bd4a23998795019ef4f370535ed5dd7afc97e
- SHA512 48f26a08f614182d59ec010b1106d0e05cf55c9f48ae70f706435e41d92e786e9c9e78008de26e6136a154d0d3d2b92fe519fc3157940bc2f34f3daad75b3d47
- SSDEEP 768:9kAMMC60OOax4t/q+BXJum2LG6Y59t54dkUOfsnutif04CG4Fz20jIz7U+376EyQ:6MRjkS1bFdh1k8Z8ZJWVmInj
- MD5 SHA1 SHA512 SSDEEP
martyrdds.ele
- SHA256 5ecdfcc07f21d459544978a2cc6ce6cea67e9ca8bc46d7ca0b069e6f492bd4a3
- MD5 aee4bb6a9e3bd66fd8d2c7f9f20d6c75
- SHA1 bdab62c341dfec94cb2e8d27c35531d8a849541e
- SHA512 e2eae217804c6596d2d23025ce1358cfb8faffda09de89c93e044838f18e83237094bef872d49bf99f47326272876a47e6e236d6db0106b56df42be7c5f82472
- SSDEEP 768:QYEycGQ020iR3UzxToaNbm/CQIHqWHLCk1jPFAsKWj2BqcuzyxA41UqJFmTzU3os:csTf/jhESARl/
- MD5 SHA1 SHA512 SSDEEP
vagabondage.fis
- SHA256 40e701ba7606b5251e9e5f3b6376b0ab06dbba76be2db51814f9a6335fc673c4
- MD5 6630050c1bc0f9002cffd4e3878af422
- SHA1 edef39db60837c4cba254aab55d03d3566c3eca8
- SHA512 899b32617790b94fcfbdb3abdcd3cdca899735851416bedbf1533123e4e92491a612a3d223fc051d16fa04c28bb74721f45705bf98e4b1c462c1c813baeaa2d2
- SSDEEP 768:oiVj0sDGFYdWIWsIdL0HBu2W06kRV073deJ5twc39KRw7kbrGgu/hIgh6QxBPK6I:bjJjsTWRuje
- MD5 SHA1 SHA512 SSDEEP