⊳🔸 𝐒𝐄𝐓𝐔𝐏2[.]exe

resource
⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe
unpack001/$PLUGINSDIR/nsExec.dll

⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 f667c428b522dde24c5524da99fdf375e3fed0ca92977f0890eb72e21e2178fb
MD5 2af5068f57164b15ab2da10f956f243c
SHA1 81a299a54ba003b307d84a220c697907bd960b54
SHA512 da761bb422af4fa8df32eaaeacb1b3d14fd0024aeb9bdb68b19a672f38168c65b34e6ae39411fb9cc61f538a16871f8e565f4e4e539cff982de9c0c3b2f33cbf
SSDEEP 24576:RVDATV2yrKLfFBWVMSiZxkHGhSPAFvF9um0rhikQWbkC146dRn3sxVCL2Q:R2luLfTDAGsPdBrEkQWt146Uo2Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Nhs.wp5

SHA256 b633515629a8672efa92f339d4110c366e4dae0bf24fe64d823f921a160c8049
MD5 92fd8dcc89353634fc6c3fc61c810ce9
SHA1 c80938a517f455c99063393469111ce134c15028
SHA512 017573c97e7696d5c6c3eed5624deb4c99674d71d3e247cb03321d9c4dea04790b640254f68cf41495dbc9fb34103e5e5af95a02e12edd42b06cfb092f193763
SSDEEP 6144:eX5U8BWVRGF8ToyT3oXRHIvdnuihPSGeRiXzoxNBW+1nvCQA:m5BWVRrTx8tIvxbQrRazoxNo+1KQA
MD5 SHA1 SHA512 SSDEEP

$TEMP/Subscriber.wp5

SHA256 bbf7d94cef70ef3fb0b7f65c6c2129009d4ac22f2648cbe2e4d8e45eac7b5663
MD5 24513f81ded7ae5c36f6bd0b9358d45a
SHA1 4388aa29fab5e5b74297f434161109fc9d5533c5
SHA512 d46160aec3b2639dc51f813664359722b35069008ff9b473342b9fe594720a2bcb1e3bfe6c0c58172780b4637a53ab291efbce4c5430cf505fe96ef84c207cf5
SSDEEP 192:zrDYEADVfRlFs4R8jQurBj3ZRXjAaeCStCRUlTzm3Ad/nw8:zOnIO8jQmj3ZRcThtJTIn8
MD5 SHA1 SHA512 SSDEEP

$TEMP/Trustees.wp5

SHA256 58035267c5e6be06cba15a406b8b8d3a21cea58b867db08dbf98c662aa2ade9c
MD5 d235e8b0d886dd7aef636c81e9f10f5e
SHA1 ee222452626bd53f4e16afd3fa46d204ffecf156
SHA512 8eac00359101191991779c255794d0cf7477c0aab9778693627b7bb960a424b3769fcf24cdf41ea7161a7b636118c9d15872e37ece3c7eef7e3ef67effa20d33
SSDEEP 6144:yOB14A4uO+wSDRiJyxu2qU6gaxpUFVC0872Pcl:yC147uZwsRrWU6gmOVCJ72O
MD5 SHA1 SHA512 SSDEEP

$TEMP/Universal.wp5

SHA256 2a637464de5ca5797cbad613eaaf03f4542a22d0704874b82e37db73df96b715
MD5 8151ce4ba7fabda446870064e874728a
SHA1 a44328ffe2fc2df4ca1238b7d816d08672f9bdf5
SHA512 a2381a231242de44b9608aaab287496d141ecfe05a8aa24bfab1d3c6d9ee19eafb0e688e52b15f139c399b8f558dfe085ea6162a8c84abc70e89dac6d9b6e460
SSDEEP 1536:O2st//cAPq/pdeuDlMh4jGerA0p8rUWvShJ2Vh/IyVUb:O2GxPApdeOJGOp8/qe7/Dw
MD5 SHA1 SHA512 SSDEEP

$TEMP/Warned.wp5

SHA256 6ef3e509da049ce7402dfede199a6acba993925b29019f63b6ca014bb1f4d8f3
MD5 fe8c2d6652af0790a1722d9594ba47c7
SHA1 b2d02fa27470b539c3ae1a238aacd6f95ad9a554
SHA512 4c03ab71e27e749821a92e697c2071447df78c3854b9c1c816e49f6631b9d350c5f6cb87bfd2a586451b75dcf2c375ffacc5735625eb72a6f64368efb15484b8
SSDEEP 12288:NbJCqN409AX3UKCz4g7PrM8Q2W12jbmDAZj19jwiz+1iT0H:7C3DYw4hR1+iikT0H
MD5 SHA1 SHA512 SSDEEP

Allen

SHA256 39cecc9cff24358ada56f2286d4ca32c6e7ee6f6915905b14dcba54058dea76e
MD5 a39e31ced8162a48558c41595366cddf
SHA1 1534f7fdba85e045051f121c64230ff3954c905a
SHA512 817ee372b5f3acba27626b1257f3845347c01086d3e17ed60f057781fe6093f0f31a748b45c7b920d7d651e612f2e9306b3fa3d88e6cc714b41018f6fcace6ba
MD5 SHA1 SHA512

Breed

SHA256 8a41fc6476174ef89754e7be819435d0015e0ec9bb74ad6b1b37b9888c6060e8
MD5 a234248b8919d9c70c39b40d72cb36bd
SHA1 95cd9833f3b0c76c12c07f1c42075da00c2704d3
SHA512 f9b1b40ba829945f8f717bb98f33851bca5cfb6116cfeb2983faf7c01e63dc58b601eb6c13e1784aacc7bcb488439e75625bd76083c832104648459cb0ee7a7e
SSDEEP 1536:h1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:h1Pfam6OzmkrJrRj
MD5 SHA1 SHA512 SSDEEP

Custom

SHA256 a045e996857ddd2c63a213678bc49bd71c8df89e388263035274d01784b97231
MD5 2762f1fc1b32835f43f0ac9d627a787c
SHA1 45f630bf614073cae4f29f558de156bb5a1adfde
SHA512 4e4fd607a2408ce492c97026a09230246f1756f0c904b60b0000b03ec10161020ea8b2bcfa3f14697f93d35559f627814eac999aa73767396363530eb1a0b158
SSDEEP 1536:E0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xeY:PeVzOqD1IGuTpMgKYbwR5ExeY
MD5 SHA1 SHA512 SSDEEP

Her

SHA256 7b3ac71b704435c09421400b38ceb669daf4df8bc268f30c066009e7b36f06ca
MD5 a4fa1c88c0867230ef1aaacbc6a472db
SHA1 863b4c0ebe664d9d9f4bbd42b8149b481310d533
SHA512 1936f906df997600ae0a6f7eb4c68279048a71794977fedf8bc7a2cf8bcfb030cf984461d755bf3e72089cc903616b49ac9ed17db883cd6db47d2b75f3d90b83
SSDEEP 3072:cMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVB4V:clXuww8x1WUyB4V
MD5 SHA1 SHA512 SSDEEP

Inspection

SHA256 933b18bbaf3d2e7baeb076025dec75d8cb6372483f22f85ba95ae0b2a9ed31fc
MD5 b3184ff15e58b4fa08542b32576a2e83
SHA1 76a2b94c9b95f40535b59dcce3083d26eb0c4524
SHA512 cf0a3e2dc834653bca4c2c98790f4d2027879ca2a8a311a166ce0b0afd4082b139c684ca2b5eb5275b51a1a568091af3ef8e775adbfdb3f2ded4125c506e43ca
SSDEEP 3072:J/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8Q:J/RTggXuN2KFIyt+8ZUlhxb8n
MD5 SHA1 SHA512 SSDEEP

Labels

SHA256 d229e5bae4a97a88c9d647b3c5467b0d58f767119f43d5bff2bdcc77793490ae
MD5 196a79ba2d8b4ed70dda9ca087b081c6
SHA1 f653b7694386d195c466401a6b9e5c83c081f36f
SHA512 73789376acda9bd0839559322363f773a8e68b52f9d6c3d35e4cd030c4a7a5679849a8bcf4b2c74ef5dde4b473d921de04e16f273e8264fe942b0588a3b266ad
SSDEEP 3072:e3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAte:e3IW5Iuh0AOz04p1dw
MD5 SHA1 SHA512 SSDEEP

Raleigh

SHA256 58b811f4ff3b3a472d8a2caf8efc2fbeaee0bdb8777b90f5a8b49f27528adf55
MD5 1d9bab936e9021c4f582b31250dda57d
SHA1 69ce16f89be76debb885ff9a7f0067835a1c34a1
SHA512 79afb2cc772f513881338b90758aca7d1d7022150809ed35cb919f151bc7d2b0998eaab162ff79043c7f89f57fe78f2fac7c15c8700f2e135c19077830b2fd96
SSDEEP 3072:W/CfXib+tSijpcVMFXD5ypAXoegz8StjOrOJI:MCf/1jpcuX0pAI8StQO2
MD5 SHA1 SHA512 SSDEEP

Shit

SHA256 bed0754c0c5c5ca337f78490d353417fa633ed3effa2272ccc2a7416461b5e1b
MD5 2b2e19972b195eb9966f493a08362085
SHA1 acbe137052ce8a9493dba3c34f870e6c2fb336f8
SHA512 9b94478d69c998a7591f46a7496d3e451eb52b5ee953d10eec0eccd025ce90b5e380ee703e6caf804a45de11f6083696235a73bd660f1223cfcba4d3fd7cefbf
SSDEEP 1536:lbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsq:AjJ8lghHzJi2ubSW4wC2mYR+HUDXOXO
MD5 SHA1 SHA512 SSDEEP

Sluts

SHA256 6095ed8a6c91e5e368740ade40a6df6c579762f66aed65a5a99e8dfe00c4cd71
MD5 e21a0e3047f3f937dba7943b41c5394b
SHA1 7e071ddd5d421ba8842ca43541997babef12e7a8
SHA512 e495960ac1285c38f538320f6f5796d7cfa0d0390bdb82775d57bf3d565ac707bb44e6f84a7e501710f462274e73777977b9451c42c1c7ab15527bb786517a5b
SSDEEP 1536:Ch63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:Ch6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Nhs.wp5

$TEMP/Subscriber.wp5

$TEMP/Trustees.wp5

$TEMP/Universal.wp5

$TEMP/Warned.wp5

Allen

Breed

Custom

Her

Inspection

Labels

Raleigh

Shit

Sluts

Sharing

General

Malware Config

Signatures

File Explorer

⊳🔸 𝐒𝐄𝐓𝐔𝐏2.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Nhs.wp5

$TEMP/Subscriber.wp5

$TEMP/Trustees.wp5

$TEMP/Universal.wp5

$TEMP/Warned.wp5

Allen

Breed

Custom

Her

Inspection

Labels

Raleigh

Shit

Sluts