Nostroller_Options_V2.0_20220830.zip
- SHA256 a0b5f70732ad42fdcab2eb2fab582833f9a9ea3504cff854987fe341d96524ae
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nostroller Options V2.0/Nostroller Options V2.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nostroller Options V2.0/Nostroller Options V2.0.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Nostroller_Options_V2.0_20220830.zip
- Size 12.6MB
- Sample260623-ammfdahs6q
- SHA256 a0b5f70732ad42fdcab2eb2fab582833f9a9ea3504cff854987fe341d96524ae
- MD5 87980198a3072104c8e59353a2d1a84b
- SHA1 7667c27b0894b9a59f69196fa852c9d0a36d692d
- SHA512 cce2eaea8aac67444e0e7e5a8177aac55937bcc281c1f3da7e489af26286507dc97f22aa87560780dfb5a643a94348119772dbdcbbdc0d1f4b0ce179d9a84a34
- SSDEEP 196608:xLs4VGrOVzt7pRWStcmMvIK636Nq/TMtQn3ypx9CVo0/0fuq31Y:Vs4bztlRWStAvIt3O2MtBP6/0fuq31Y
- TLSH T142D633B1C440EC90FFAD27388B33F95B5169AFEB779DF14A7D526448EA6538820C09C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nostroller Options V2.0/Nostroller Options V2.0.exe
File Explorer
-
Nostroller_Options_V2.0_20220830.zip.zip 12.6MB
-
Nostroller Options V2.0/Nostroller Options V2.0.exe.exe 13.6MB
-
Nostroller Options V2.0/SS520_APP_V006_RC_20220830.skystar300KB
-
Nostroller Options V2.0/languagepack.xml.xml 16KB
Nostroller Options V2.0/Nostroller Options V2.0.exe
- SHA256 3fa2764c014a709e27292a0507bd59dad69fd34d008e791be5694f427a62004b
- MD5 e3f8f020efe0e0283d4e5a975ca8e77b
- SHA1 a1f1869c5f02360cbfea7bc40de8610bfddd300a
- SHA512 c03e05cc72a81210078e963d10851b252bf67c58061bfba25937a03b295a2f25aaa0eff4763e239360a15960fc4ca14d5f6e1ba8c6cae27db52c84cb9e17dd1f
- SSDEEP 196608:nqKaY1IR1ZqfxZdXNSUVo5J3V0B4362StSgciD5brhAyW9DkdAEbJTz7CuGOo4:qw6R1Ufm/51q4K22Oi3iBdEbJTzOrOl
- TLSH T173E623BFA22149FCE09AC27885C3C592C6713D0C1A665BDF22CA165B0E37B943E7C55E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
309920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc
hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write
Name
.text
Size
317KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
751KB
Virtual Size
751KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.enigma1
Size
11.8MB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.enigma2
Size
676KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30141,
count=6, id=257, version=30034,
count=33, id=261, version=30034,
count=10, id=260, version=30034,
count=4, id=259, version=30034,
count=8, id=257, version=27412,
count=1, id=261, version=30140,
count=7, id=257, version=30140,
count=985, id=1, productName=Unmarked objects,
count=2, id=260, version=30141,
count=39, id=261, version=30141,
count=1, id=256, version=30141,
count=1, id=255, version=30141,
count=1, id=151,
count=1, id=258, version=30141,
Nostroller Options V2.0/SS520_APP_V006_RC_20220830.skystar
- SHA256 2dd2b385c2c1992a235a429b46f09681c8995ea371969727d2204b234558bb8f
- MD5 52a619495c4aaeb7a6e9342f72bc7dbe
- SHA1 6b34f8e11ef1f7edf738fecbf0f878d8dc0105fc
- SHA512 b4533c0fb93e1a6c7d26c4ac20171db3cc2c1476567f99c1cd98cb66b5f9a33ad657dc2c5a16e437832a075823b58ed6886f2820949042c1ba38b7518b64880d
- SSDEEP 1536:37dW3hcFmiDtbDgSSU6eRkbnY9R1q5DOHJ:37dmi5HgSSUxon/qJ
- TLSH T18164662F4217158EF4E1938AAE4B985837E4275D3CCA051FB5EB1203B933D1369A8E6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Nostroller Options V2.0/languagepack.xml
- SHA256 05a991c1ea512976aea8448857d02172b0eca036321f112ec8b7b2a3a0f6a0b2
- MD5 a699e26e6c5fb8533f543c7bf8e0ba0e
- SHA1 8a1d777d21dfe988c57ea96de1fa39f4b51eab52
- SHA512 4e86969deddc530b52a03307f000f67b38c5f669f3dfc15769a4b929e358fbfa20ce5610069adf77856f7c78c868c23275f77296d64feb8642609286143b3095
- SSDEEP 384:EkBqBKA9pR1h15oqeFbH3TEATEqOKXnzDQ:EkYBpTeFjfUgnzDQ
- TLSH T14672A6ADF3C68B70D67800228A09D958FD193E8BD9258125B45FDC37976A8BCF123A71
- MD5 SHA1 SHA512 SSDEEP TLSH