BESTCOMSPlus_51201_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BESTCOMSPlus_51201_Installer.exe
Size 274.5MB
Sample260623-tth63set4x
SHA256 d0b29db1002941db89d66fc843e96b6c1b775aca667f75787dfe1f233f471164
MD5 2494239f4c24fd3a46f0637478bfff8f
SHA1 f09d24b40565ebe4c70565ef3a00a1f8c9cb6630
SHA512 648948c3b2ce3a0349f8e3d4969840122e80c6fe1b28598b79f4b34512bc284b9e6f777522fb603ee4ef2f725ae02c6a1e2dba11592b4b03d1b54dd0ad925594
SSDEEP 6291456:wODOZPdT20q1sQAbEFWDXMHTZymB9mV3oQ8EoufmY/LQEKtuoOD:wOqBdTq5AbDDXMHTUgKoYbft0EK8jD
TLSH
T189D833B710AEDB7EF1B1A930D6B87A5C061278D21A33D912D7969CF08A53893F074ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

BESTCOMSPlus_51201_Installer.exe

.exe 274.5MB

BESTCOMSPlus_51201_Installer.exe

IMPHASH ac59abe7eadfae9e29c05844dca6e49c
SHA256 d0b29db1002941db89d66fc843e96b6c1b775aca667f75787dfe1f233f471164
MD5 2494239f4c24fd3a46f0637478bfff8f
SHA1 f09d24b40565ebe4c70565ef3a00a1f8c9cb6630
SHA512 648948c3b2ce3a0349f8e3d4969840122e80c6fe1b28598b79f4b34512bc284b9e6f777522fb603ee4ef2f725ae02c6a1e2dba11592b4b03d1b54dd0ad925594
SSDEEP 6291456:wODOZPdT20q1sQAbEFWDXMHTZymB9mV3oQ8EoufmY/LQEKtuoOD:wOqBdTq5AbDDXMHTUgKoYbft0EK8jD
TLSH
T189D833B710AEDB7EF1B1A930D6B87A5C061278D21A33D912D7969CF08A53893F074ED1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

[email protected]

Digest

15:20:94:91:10:6c:30:a2:be:1e:14:40:47:18:41:ba:bf:52:ad:52:c7:9e:a9:b4:51:b3:38:d5:e1:fc:0f:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=29626197,CN=Basler Electric Company,O=Basler Electric Company,L=Highland,ST=Illinois,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1308496c6c696e6f6973,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 2, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:65:c5:b0:16:05:fb:2a:5a:27:9c:cc:7e:0f:0a:e7

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2024 - Nov 12, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

156660

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builder\WorkingDirectory\SharpSetup\Release\Bootstrapper.pdb

comctl32

InitCommonControlsEx

kernel32

SetLastError GetCurrentProcess FlushInstructionCache GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW LockResource LoadResource FindResourceW MultiByteToWideChar lstrlenA CreateDirectoryW SetCurrentDirectoryW GetTempPathW FindFirstFileW FindNextFileW FindClose DeleteFileW MoveFileExW RemoveDirectoryW GlobalHandle GlobalFree CreateDirectoryA CreateMutexW FindResourceExW GetModuleHandleW CreateFileW GetFileSize CloseHandle Sleep ExitProcess LocalFree CreateProcessW WaitForSingleObject GetExitCodeProcess CreateThread SuspendThread TerminateThread ReleaseMutex ResumeThread SetThreadLocale GetCurrentDirectoryW GetFileAttributesW SizeofResource GetVersionExW GetSystemInfo InterlockedDecrement GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle HeapReAlloc RaiseException HeapCreate SetEnvironmentVariableW SetEnvironmentVariableA SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess LCMapStringW RtlUnwind GetStartupInfoW GetSystemTimeAsFileTime GetCPInfo ReadFile GetConsoleMode GetConsoleCP WriteFile SetFilePointer InitializeCriticalSection GetStringTypeW InterlockedExchange WideCharToMultiByte InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange WriteConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFileA FlushFileBuffers GetLocaleInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetProcAddress LoadLibraryW GetLocaleInfoA GetCurrentThreadId lstrlenW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetLastError GetCommandLineW FreeLibrary SetStdHandle GetFileType EnumSystemLocalesA IsValidLocale CompareStringW SetEndOfFile HeapSize

user32

RegisterWindowMessageW SetWindowContextHelpId MapDialogRect EndDialog PostQuitMessage GetActiveWindow wsprintfW DialogBoxIndirectParamW MessageBoxW GetMenu AdjustWindowRectEx ShowWindow SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx ExitWindowsEx GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetFocus SetFocus GetDlgItem SendMessageW IsWindow GetClassNameW GetSysColor CharNextW RedrawWindow LoadCursorW GetClassInfoExW RegisterClassExW DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW DestroyWindow CreateAcceleratorTableW ClientToScreen GetParent ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect GetClientRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable SetWindowPos GetWindow SendDlgItemMessageW UnregisterClassA

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush

advapi32

AdjustTokenPrivileges RegCreateKeyExW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegQueryValueExW RegOpenKeyExW RegSetValueExW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CLSIDFromString CLSIDFromProgID CoGetClassObject OleUninitialize CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleInitialize CoCreateGuid CoCreateInstance

oleaut32

SysFreeString VariantClear VariantInit SysStringLen SysAllocString LoadRegTypeLi LoadTypeLi SysAllocStringLen OleCreateFontIndirect

shlwapi

PathCombineW PathCanonicalizeW PathFileExistsW PathIsRelativeW

Sharing

General

Malware Config

Signatures

File Explorer

BESTCOMSPlus_51201_Installer.exe

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic