Q-M20251302[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Q-M20251302.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 0a55167fd6274ab545220243dcf2122a91c822e056859fbc9f617d7dbd2dfbb5
MD5 4b790bfe7b7c165fb567d17b7fcd9348
SHA1 6313514ffe723ddbca6fb4caa3fda967a13f309b
SHA512 fa4faec78a5f327758aedec821f7b8120906696446aa2291d52beb15ad2dc89abd4e9e31def11e49b4c39e2b03ffe4626ed721d1eedfb87cbcb41a853dee2729
SSDEEP 12288:oF9ULOvBp5dYTAJpaE223R8Scy38SeD83S1nVCD1xnE8UML789zUO9vVOI0emBmv:A/vnXQop9uS13lRsnkpxnlGUOdb0emBy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

dc:d9:09:7e:e4:a6:32:a7:ab:91:26:77:1c:5a:a1:ab:91:67:93:c5:52:4b:69:1d:9a:eb:d8:98:47:76:d4:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Strg,OU=Ltnings Unguilefully Aurin\ ,O=Strg,L=Mannheim,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c194b616c61736572313338404272616e6462796c6465722e4e6f

Chains

Feb 11, 2025

PE Signature issue

Digest

fd:41:1c:b9:2f:b8:e7:3e:11:cd:16:e0:3a:40:74:bd:79:4a:fc:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Strg,OU=Ltnings Unguilefully Aurin\ ,O=Strg,L=Mannheim,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c194b616c61736572313338404272616e6462796c6465722e4e6f

Chains

Feb 11, 2025

Minor OS version

0

Major OS version

4

Entry point

12555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Brugtbaaden.mir

SHA256 da863fd8a33911178bb60381b97d22624d807f5bc4ca37686b8c92d791e89ce5
MD5 f7d63918b6b40563e2ec199b5c6ec972
SHA1 1b4fb64baf5e1450275b992d4fe873c88875d8a3
SHA512 2cbee02c9ea875c5dce35db0d0562ce2f4d5f445ad9ed3e2ccff0f96196debff3a6b0dacd66c35924a12fc89c87bd106cf14952e69335b3cca3ec7f6c4934e3a
SSDEEP 3072:sNhxHVJGCMe4DJfCDW/VK5oybWfGwIvAS3VQNSzywevgkp4UBsXTD/hhDjAMizDt:Vo6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Dataopsamler.txt

SHA256 0b971e121b3c7febc9410476a74907642e0f8f8204822537d74af8a50723f5f9
MD5 7e8f4b9bed8bdbfc941807bc96cb41e6
SHA1 729b0ca9d7562c54d28b0f57c5ae61f8354efd75
SHA512 fde3e973887e4f8fb4b5c34198849a7259fc86dbf2572e04ed3e4eae6278e2d3888e4357eba388d7cf81804673bc14514961f43c692eb1e12f265f26a1df2cc6
MD5 SHA1 SHA512

NSIS installer

installer

Fiskefarsens89.vol

SHA256 7334ac90957919ae6cd7afd2fcbdebdaeb1bf8aa396f05129cb770ac0f4fd248
MD5 bdce727a701c35e4de15bc2a1f219bc7
SHA1 22762a04dfb2c0c5bea8b1f27f02cf58edc0bfed
SHA512 cf9203c67b871aa76cc265349f91bf0bc99a55944974f5375630e769d82ac2d2d418bf45cc5d954963897dcc649f1f10a53c001c236f5bcc957c872646bcd9b7
SSDEEP 3072:KSv3sPKL0iFOpDsUOQu829GutPufm0/rUJPH0MPYUcUIaDvko80GNmDXjPJ4jrYB:aQf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unaldermanly15.Lif

SHA256 6e7303d7e1e0311e9069341ac4845aa3da34789c8756ea928998dcae9fa8ac73
MD5 9b49cad305fda98053724981cdc19513
SHA1 8bcd85ce932b2020126b59f91304cada2992037c
SHA512 9a91abef19203dcf208e979580103d113f756dfc8e75b59db1e7367816f63deff6ba5c3328c2e9c720710441e9f4c1cf8b58bcd3584ad144c6a2a95585057eb5
SSDEEP 3072:+DHIH4efasTOUhyJDJb2lvtJ/nHitD3t4/:+DHi4efasTdEJDJbkvtJ/nHiZ94/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

banaleres.ini

SHA256 6e2934a9776021e3cfa83a15881b8cec3383430942d9b8615dbd44d40645d9ba
MD5 d3cac3a0f494ee7fcbce1a89cd6ffaa4
SHA1 153562ec6a940738807c613282270ff748aacf2c
SHA512 6e7469af5e41eee0308bb5e13f427ea6bdbc93345b2170bc8f4402a9c78e3e75d4704fd50ca7d2adfbbf688af8501dc1bcd2cbe402de751d0c8d2836a3055cc1
MD5 SHA1 SHA512

NSIS installer

installer

engagerede.hal

SHA256 72367c166dc89ab6e47e7e71e994190c2101111ea44d9b8611ebf17b97ee4798
MD5 8b89d98b81abb4e360c4df77f81a31df
SHA1 292b0c91a0587e6ccb71a3253dafcfcf41378c97
SHA512 afea124d6f4fb1245a1b97277da3550c63b502f722c6d3f827b5cb01fec6414710ec5c1e89e87c0ed5c17e8e7f0569fbe87cc2005f8ef80ede7494f54c72b8ba
SSDEEP 3072:IEGSSU4R2gkPMQzzFBEIDsBSYu6XQmUTjL9pdepA+v3m8FwMPtTy/0Mvnzelrsqc:B
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

evoe.kra

SHA256 7aaa235c32bd948d9fffe8c911903e1009c6fc39ec0551b56337e943c759b7ee
MD5 99b6b040b480cecf03dda3736f118ac7
SHA1 e4b6ae0153e99787b4b9494047e5292945117e8e
SHA512 5ca27cec1869d4313507c06e61ae561e8a09a572a475289f0fac860aa8e7b8f037a4bd31abf1f40fa79b282067ead23299e1a7d6e31c315826cf5a6e625137d7
SSDEEP 3072:go0U4zUOntsgYrXE3n5cqlO1GhBsKVbFdnv9l94Oazh2+P1lM8qDC:1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

provostry.txt

SHA256 cd3cccc0a91ab2adf1140eb135b715d61a34603efa0ffa9a2f6e4e679e65691f
MD5 c077efaecb929c6477130c79e2cd32dd
SHA1 3644c85e6251cbe76f45b1e173aaf26808fe25b0
SHA512 34d77006925dbe19c7006169228b45cc5b089bfd20f63f3a0cd85db1ac8e86966fe56d73d912e60e8d17bb79f3f65f03983535236a87bdb1e58d6b73ab04b210
MD5 SHA1 SHA512

NSIS installer

installer

retrograde.ini

SHA256 97ed5676fedf53f00278e75182d5428b51893f094bafc14d4be3a0ac01a28be4
MD5 65a0b276917be19f4cb5977e6dc35098
SHA1 c5d324345757f6b0cb9508ad50f3ff0015f2e36f
SHA512 18894d67c31802c57ec5cf102c46cbf39c63b4c22386163d4f9fcdbe7f4681ed0a5d121f11807309c963d2a8092b59d4b6cb2fcb484c4c8f49b9a4c3c6350179
MD5 SHA1 SHA512

NSIS installer

installer

superstar.Int

SHA256 b96684dc7d545eea21c425a1c65a7a64a907266f70178793a3c3ce4155cf1eb6
MD5 568fb90e46a787352eefe609c8bc9b2f
SHA1 d1e1cdd81453f81b2f8d00095e7e90143769c48c
SHA512 62db5557e0d18153a0f6958206ea231108f91174df6497d3db18d5b8ee026831ba8e0c06703d83e2889213f7ef2a2e2afd24b5278fa920620ae483d14814ad45
SSDEEP 3072:QG46qVOCCTdnBf5mR+saUqeV4JdxrXbm1nsXmSu2Ux+3y/GL+iHoi+BxWmKi:QG4NHqdBf5mKo2GcSk3p+woi+BfL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Q-M20251302.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brugtbaaden.mir

Dataopsamler.txt

Fiskefarsens89.vol

Unaldermanly15.Lif

banaleres.ini

engagerede.hal

evoe.kra

provostry.txt

retrograde.ini

superstar.Int

Sharing

General

Malware Config

Signatures

File Explorer

Q-M20251302.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Brugtbaaden.mir

Dataopsamler.txt

Fiskefarsens89.vol

Unaldermanly15.Lif

banaleres.ini

engagerede.hal

evoe.kra

provostry.txt

retrograde.ini

superstar.Int