b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0[.]exe

resource
b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0.exe
unpack001/$PLUGINSDIR/System.dll

b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0
MD5 d022205d82dd10c284166ad80d5c9d22
SHA1 cd94d67990828d7ea5513c1faf0ea3fc047c9b8c
SHA512 a006f733a6b2a09e9ee1935784c05becf8bda822be737c523fcfa2af12ed072da4e6485378faecc38b4f2cf761256adb077abdefa4398827cbda50ef60f539db
SSDEEP 6144:zQ606xy+J5ulYpE7AamO/hv/ZsoOYLPix+VTH3jNYdBWOHku:o+3ZamOpHSzaL3jNYdMaku
TLSH
T15174F113B330D963C628073144D76B768739EE242E1F8B471358BF5F3DB6282A91B299
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
TLSH
T10D325D06235081F3E1914138846B3E175B7A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bolection/brndslerne.cue

SHA256 497df785dc95fe961e4ae9b9ac89a72205d05cd614ac6d82dc80749b16ac988e
MD5 cb38c9c8260995ba37ef436883a0f482
SHA1 83c7e12d474fcd4829274dea9ca03b197b277571
SHA512 5f02dcdc73242bfab7d9c621579974c890ae8ffaeefd025b991b3dc6d4b2579f7ae1d5336a5c6276ffd0575dcc696253e636fb5298d44d43030a1e773fa221c0
SSDEEP 48:RCicnpKKqLg1Du8nAkC+LoFgVHUzIiqvYyXeB1B:RCicpKKqUDlm7mVHUsSB1B
TLSH
T183735B02B8111302A7760140FC9B25B180D2F481E2EB889F6C6D632C7F7D970E819AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Bolection/cytoplast.dis

SHA256 bb34d36226dd5c346bb61795912f1d024886dc0b99ed044cc89d414a2242fbda
MD5 e9c792ca0792f4435394e1caf89f8dc9
SHA1 2fc94f4114fad1f6c3ebe38e3fcc59f63d61d875
SHA512 6d9f54fa24e760042ad9bb2b3da25e3673adf1848079cf0af7d04a064f371114bbbbd0ef9bb6976786d473a3733e58bc6f36e29e4ff9a9e7c131e7156935d9c0
SSDEEP 96:IMcOhU8dQh0v+R4jGUXZGEBtDK1KUjM2h/:/QLR4jGUJ3I1
TLSH
T101530AC14B356B8960C54DC8762CAB0A67AA43761F7CCBAD7305509E72D1EA2FB21D18
MD5 SHA1 SHA512 SSDEEP TLSH

Cigaretrrets/skriblere.afs

SHA256 9aa5bfeb472533a04254645aae208a6d8de1d942246495e47b56fc3213ccbabd
MD5 72a22f233545cea82173271341817c11
SHA1 045d4b39074dbe064be1ecabd97cc823fbf3b738
SHA512 42f3640a752f36bf2454196bff0e29d012968e4f8604374c548789d981ad6fd549c0728286438a4dd60a4bebcafd6173b4ec1b5115733dfc91a2e9b6a3655171
SSDEEP 96:K0mtotHEHw1eVnkPG/wYZgUJAYzZ+fLpqtU1fVPXK0IKSIARVO:ctohErREGoYZ9aY0pqq1fV/K/I7
TLSH
T1CE733A1FEA14AD0EBC596E84A3DF7C64720C76516F62D32A1B88C9036DE3F4F445E291
MD5 SHA1 SHA512 SSDEEP TLSH

Cigaretrrets/strmsvigtenes.sam

SHA256 ceb9e7a88444f4577ae54e63db8bcbcc7bc82ce6469e783e0556baaaa4503ece
MD5 46c4659a91145b35cb0a1d0f47cdfa40
SHA1 fe6506b37cee3f049435282bdcf478e4748ea65e
SHA512 17c392e1f427ad4e711e0a76f7c80ae7dbae84309d9a8482ebdb49d7e1d8016c12e8bc79fde0dee43f9ba218cb0c8149add52ce90d1b4de2cbc77050f1c6a4a0
SSDEEP 48:5WKVBf00hTgy+c6HH0PcukJ38ZquV134dS0Sh83wp:/9gyz6/ukJ89vXFp
TLSH
T1BBE2C851B6C41C2A195F7035E3434093CD0FFCB2817B112A38BD00D08F4714C4259B21
MD5 SHA1 SHA512 SSDEEP TLSH

Coasterne

SHA256 8c3586d4bf7b57059c60d6c159fa0d9b7de3b3f01fd00996f5ff7f18fa455612
MD5 b979c72e609a0cc463884d1b0d9a57b4
SHA1 c353b083165249d46c61f66e084b17c2751539ef
SHA512 0e6efb4c8da33b174adbb12f7ad5e62da49d0bec378a5b547ebadf441582097e68df49582fc7eaa80b9cb3743f0c9da7af820830a6800f531335454f061322fe
SSDEEP 3072:cA7ewqXV3b+Kf2o92exSVAMTEZLldFiDWTAjQnegD:cwLqFX12ySeMTILldFiDWTMQegD
TLSH
T1EEF3F158975BFFE5D4034538A9BEB2E71A00680B5204C6E9C1B29F9783FB1DBB360384
MD5 SHA1 SHA512 SSDEEP TLSH

Rebox/frynsende.kom

SHA256 5d4dfdb27819a79c9f7e4c7a6f78fbcc6972b29c3da840c0af2a4c88d7be3870
MD5 c0e98af1bf4c94bb5c46da2ea317ec7d
SHA1 7503a102e62ccfb4060d6bd6966f2ee0854977f6
SHA512 b2f24287aa575bff0a109b7b0b19baf73f41cc3160a3a06e03d2bdc924f6f21bb4b5150c303c998cba89a1f2de44ed335a3f501dcb7733691441ca4dde4faa5b
SSDEEP 48:wvZOEgabSUvAVwyshpoqVhZx1RBkL+lPvkCr1GQzaK9b:wQE9bSUvJrlVpRkL+lEw1GHab
TLSH
T10D631AB82355DCB379B84E72841A99CB80D349A9AE53024326087F58890DF035EA1863
MD5 SHA1 SHA512 SSDEEP TLSH

Rebox/homoiousious.ver

SHA256 55a838c1e1b60bb87ba2f9f604a2a5d122483aebb6254fbd2a64d7583f7b2dea
MD5 f81c904b552e29ce3722daafdf0c4890
SHA1 258ad48e9b26a767638c99a2ae2da3884a81eca7
SHA512 44bbe98f31aa4cbfb60bd6ac8eb43d10e3f1a0fb74eb3b45b9f50e16ed118487e0642f252f968c13417475c32c94209d8da87939a121e5fbe8f8309b3648c00b
SSDEEP 48:+NJ8Ajkgncr2ztnwGrerFHOWlnZ0DHzHw2Xvhr2W:+YQz9b08TQCVn
TLSH
T1E933D6515905B928DD2733E01E14EFCED82A0A99E865EE2DB260A45D356B82F680A84C
MD5 SHA1 SHA512 SSDEEP TLSH

Rebox/maskinchefers.kab

SHA256 7a381883b4cd471f8730a333a7ccd07e4989a40fe327bc8cd33a210f2d6d17bc
MD5 ade1ec2a20a22c0fcf55ddfdc344b034
SHA1 689950ed1b3608451b8fc77e4f48db47d0112529
SHA512 1523201bca19bcbfe1534b2ee20099107bf717abd87186f70f0ccea63adb89c6c56ba245d1bbb874e31a5e63d33690635f5541bb6b08f39d3e156b94f6f5855b
SSDEEP 6:DZHNbkDEdNNmLlAD/sNNj4mzNE/12HrNN8:D93TI5BDc8CQD8
TLSH
T157F122EE4CE7237E8E3FED7B02E2290A038A80C0E36C840A9CA2678C51080910C04A12
MD5 SHA1 SHA512 SSDEEP TLSH

Rebox/myrianida.ttt

SHA256 a57ac9a6a6168495de7ccb0a884ac5d368bf73a51a650b0ffe9cba09fe26c234
MD5 026f4f652b075ed694d813f8dc1b8cca
SHA1 1a6416edfa6109ac53d72bb1fc16174eb5bc1bb8
SHA512 27e91c984e9a9387bf7d8a91697e5a86ebaa4079597015060d5b21214975049e9bb1f389b73004067628cfe9302b731b4a2c21cbf3f9d97d0346bc1d0c27ba75
SSDEEP 48:JOvZKJ5A+UKQTmY9v2KWEUv6b6LvlNYuS2/xa:JOvoJ5A+9QTmY92LEm6b6LvTYuD/w
TLSH
T13B03B77746C7734B2004DC2F15E62B87C3711BB411BB673C582D0A0983EDA13AB26BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Webwork.pap

SHA256 4916b19a56d0555fa32d8c404de1caf260d35bdae910fa917fb8d96376ff01a2
MD5 4a1e525197e916af56417cd6201ef62c
SHA1 8c5ef1254c8073feeecb4e659f0a72e796c9c758
SHA512 64ddcf143a9be0bde6eb06e9f859fe362bf648b4e7d971df90c1397d22774ced1f197943f5c96c7c68dd3ac09d3f3b9504e837f1d99b4e2f8462003244ba748b
SSDEEP 96:CU9Oqw0nJk/pwI6QNmCpZ9Pg3/7EeChNxsIMI9gJS9DoZ2Q0Sx:CsOq5kZdDdg3zEDhNxlX4SVqF
TLSH
T1CD432805CFCA72171F42C1A626258B1E402F6EA8A5AB23C9673B2F9599BD305843A537
MD5 SHA1 SHA512 SSDEEP TLSH

abigeat.tae

SHA256 7d1c98c2c5692e0cab8cf3c2d0b6bd019c84f6021d3ccde3061703188cae7b6a
MD5 dd924c6d51def381d2a00d58156a9507
SHA1 bcc61198b0c7556bfa7c15bbfd1b36814fc8f729
SHA512 f78cbe86c0e24be04624890f1f0cc5ed5d5aff4f8be350c891804ea9f42ebbf73e8cdbe7891997b7ab1c27e3d0ae11d96e9613e8a39d5eabb6e78379cd39268c
SSDEEP 24:ojhBpnV8KuUdfKxmYadJNMYbdvIEYvYORUh/Lxas:ojjpnVRuI0YbebvYOOks
TLSH
T1CEA2B07A6270133983C4F48BBF82001E84B78682340133CCAA372BEE2841200824AAA8
MD5 SHA1 SHA512 SSDEEP TLSH

b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bolection/brndslerne.cue

Bolection/cytoplast.dis

Cigaretrrets/skriblere.afs

Cigaretrrets/strmsvigtenes.sam

Coasterne

Rebox/frynsende.kom

Rebox/homoiousious.ver

Rebox/maskinchefers.kab

Rebox/myrianida.ttt

Webwork.pap

abigeat.tae

Sharing

General

Malware Config

Signatures

File Explorer

b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bolection/brndslerne.cue

Bolection/cytoplast.dis

Cigaretrrets/skriblere.afs

Cigaretrrets/strmsvigtenes.sam

Coasterne

Rebox/frynsende.kom

Rebox/homoiousious.ver

Rebox/maskinchefers.kab

Rebox/myrianida.ttt

Webwork.pap

abigeat.tae