wnetwatcher_setup[.]exe

resource	yara_rule
static1/unpack002/out.upx	Nirsoft

resource	yara_rule
static1/unpack001/WNetWatcher.exe	upx

resource
wnetwatcher_setup.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/WNetWatcher.exe
unpack002/out.upx
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

wnetwatcher_setup.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f
MD5 e9c4b160ad57a8957ae59dc4caabc875
SHA1 9f62b2b91d842c3bdd69f749c09242a62ee9ab73
SHA512 2e400a5d538f81e8383ecf3f8fd7497271416604d3d44b62ffa4ce492f4c9415194894daea09e85282dd3c452c4d7453bcd694ded56e974972837a31201d76ad
SSDEEP 12288:USw+OQBxGNZPjv7XLVSVLXs1cGMreMwcbnvXYJ0buziVWqpEA:USw+OQfGnUnsHUvXYzzvA
TLSH
T13AC4235B61C4D437CA2A0D718E7FC3FB92DBEA402D5C4A971F965E367C122C16A068D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
MD5 3809b1424d53ccb427c88cabab8b5f94
SHA1 bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
SHA512 626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
SSDEEP 192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO
TLSH
T13D523A51778888F3E792053EB45237079F9D5226B8929ED1CA331FC22D2B19E2FB1302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/StartMenu.dll

IMPHASH 7868cd55f358bfb360f9eb8ce1512ca0
SHA256 ac53840d019b746ab5dabaa40d7720c9a4487c861b155926454bf8b10bd0963d
MD5 8262fbc2a172ff04146e7587649d7091
SHA1 628be3fede2a79d4b321b12f979711caf77e8a7e
SHA512 8e11f1f1811a424b1ae5ab8e064d5313adc118ee7607f6a6f9b9976647ca6c91496133d5575d4737386a1485f39cf6fd074dbfd619807f42fe148a640186f639
SSDEEP 96:Z+rBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tXGhEl5VN:Z+FepxPE1r8/FtmCDtWg5v
TLSH
T1F0E1F87AF7C044F3D68B43702863BB17EB669A211725B163992716CAB5C24E3DC34722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

WNetWatcher.chm

SHA256 4582303cdbf8ef07579c19c567a6ba04c7620aa35ecf553cd4489773681aba81
MD5 e02a94baeb4e86951a2b2f7ee4c01d92
SHA1 f02836bd7417f60d2e0c08520fd1248e014c4f74
SHA512 2ef906b791b025b431b01ca804e6f923f6deeac71f5c49d505afaef685424cb2d6dc799c6b7c27d8e021c32ecf437a608bbb05c6173add79002a10ae43685e51
SSDEEP 384:bTgVEyiIlEiDkPecxDq9Sc2JoTylMQbGZ6fjLdeGbp8rwHbN4c427b+:bTg4CFDkGqDq9BTyl7deGar0b9Li
TLSH
T1FAC2D040E4222613CA97067FE9D3BD49AB2CAC43BD646053C69B97AE7E0D30516729DC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

WNetWatcher.exe

SHA256 3295f058f7eb0ae972d078530a3003d48ca4df16f2538a73bce9497d0f688bf9
MD5 17b08e40b85747d64ab474f0667cc155
SHA1 5c8bfc69ff7b238b3dd82328b150df55b8514202
SHA512 e7b86a9c49159f6cf87b98931fa9b164a6559d414cbbf9833139239e8d42674d94ec6f1941d83d3c0ed4b1a8c2015b5df399ce8bccf780f5759b5155369a19b3
SSDEEP 12288:DcD2VMa5qhDdEatGK8byytcVvhbFeruEwpf:OyMa56Eatobyytwhb4rlwpf
TLSH
T178B423547E5D1592DAA946339880721D9034CF34BCBB97A2F01ECDBA3E0F3A84751BCA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1470176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 d93ced06483bca60966c7ab5e723ab178d43871bad9e90fd68d34ade427d40f7
MD5 e4d7e95c7fec13259fae7bd965474df2
SHA1 35b70e85c84c5f4f45e4958e6196ef0f91fd27a9
SHA512 eaf34f554d08e4b12b5e8972baffe55df58585c0da9f07088326a1a8e122408c204ef2201129a7315d9a169db94e5810294be2dcbebae8b49ce26d159389c6cb
SSDEEP 24576:COjHkqm7TF9GZgrYm9m5rQ4qhxw9sC9oYmLVcn927Ak76BlTumdbxTY6YKii9sXq:LjHkqm7TXGirYm9m5rQ4qPw9V9oYmLVE
TLSH
T16765D8D4777FB1B2E70E25BD36822EC5093E6A8C321C53137235949090FA8EB77E8959
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4836

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

readme.txt

SHA256 a7f26fe818bbff97bc93e399ab225863c41aa6fdd4c89d596cc30fc7f0dd7543
MD5 7f6eaa69e6f08bdefd79dc362ab8a5f4
SHA1 067ee5723d910254538a2b58ecdd39b8a0c06e2a
SHA512 f18b3a940c4689266608026db08d85064401f2bcaaea1834a8d5ab6eff2e804e7053f999ececb6c6a8368d600814e6ec7ee4abce186fbf16b42f0667a4e34ee8
SSDEEP 384:ROni2owXWivVBaf9bvmKv0Yq7m849iAL3jeSiarhGbapb5beCaTKz1PYsFS5cL2E:X3wXWivVBaf9bvmKv0YqC5iALTeSPkev
TLSH
T15DB266172287233005731291978DB2A2E37642FE574A19FD747CC15C2BB6326E3FA5E9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninst.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 cb20c7ff0d519038030763ceebac9136133ee69996c91055abd4db4239aef3b5
MD5 ec7e613f8291ab0e8fb65a0985e0f491
SHA1 89dad54132ec4d7e24a1648d2fe6839fd333c05f
SHA512 39812fedf5a8b221128090c845ea736155df86c22aeefd623832b7e10d1282b59bc4358ca6b8395965676eb2b34cf823291025938014e51d18bbf6da1c64c57b
SSDEEP 768:s/UpAHiGjRQ1kkjH918xnyzOp7OssT1pF/O71mJ/6gd2iZQAm6kRRS+NoJRneYwy:QUeHiWRgkkjH8nyWmJygdLeAyNxO
TLSH
T10923AE0A36C0C8B7D5AA067119B7CBBBF7FAF70116100A675B504FBF6921283EE15297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

wnetwatcher_setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

WNetWatcher.chm

WNetWatcher.exe

generic

out.upx

generic

readme.txt

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic