2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40
MD5 b7fddc0f52aa19361bb43414efe86378
SHA1 1b09f4837c3c401aca9c1d5bc22f5a1b393c1f4a
SHA512 8d0dc898c1e337358f3659a0139168c51bef2dbc8fe34f0e99f93a312cce24a5bbf7371481f94676a5789f39f2e4d60113e00dc8551612d424afefd744c785cb
SSDEEP 6144:cpZgUXltNBTzek8VuyT9oajCYQXwa8ya1f20lCnTZ8Ikv:EFeduQoaj8c8uCT0
TLSH
T1D654D082758490EBDA256470C8ABDD334B277FBA47D15B0F23B6762E64731630A2F50B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6c:38:f1:3e:b0:59:89:c1:6d:f6:5b:83:a5:4e:d0:ae:1b:17:97:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Illustrous,OU=Bemadams Quitch Valentijn\ ,O=Illustrous,C=DE,1.2.840.113549.1.9.1=#0c2050756464696e6768656164656440446563696d616c64656c656e65732e537267

Chains

Jul 17, 2026

CN=Illustrous,OU=Bemadams Quitch Valentijn\ ,O=Illustrous,C=DE,1.2.840.113549.1.9.1=#0c2050756464696e6768656164656440446563696d616c64656c656e65732e537267

Minor OS version

0

Major OS version

4

Entry point

12707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
MD5 b3070cf20db659fdfb3cb2ed38130e8d
SHA1 aa234b0620bebddde1414ff6b0840d883890b413
SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
TLSH
T1DE121A635A4055F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF531A7D3A351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
TLSH
T16BD1097675E22EB3C50ACA313C127A2B57F8C8111B9401549B938BD238C5EB3EA28282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Containeriserings

SHA256 5fcd7a53be727eab20a22b8fcd95f3831e47e6c71318c83f2dda18f7ffac5718
MD5 e2e4a97be261f7546f69867f545f58a7
SHA1 cca73933d8af61a591e90c7dca9e480a0635b0ff
SHA512 95957fee1f7852952053dc918bd49a814e56589b314b1228c420bd1f373197910997d86fff5fd35ad040fff9d9eb7e0fc9eb529e9496ba61a43890bd85461d9d
SSDEEP 384:NqD5aSryziaN9AOJjiR0f31jputj37PZfcynA3fXV:NXGs5OOJWR0flGPqykfl
TLSH
T1B0928CA1DB069FFACD0FE038DC7966A54818741A4A4FA0BF68749415C1D61E23278EAF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Lipogenic.fac

SHA256 0dbbdd1570fb34e19ec3cc6262bfa67fb5d3256e1af43e84d589a11b0263b787
MD5 8088172f6c04655496405220d9f52150
SHA1 17a9581ba9556fe2f84fb547081d854c5846bf42
SHA512 ef7ec5bf1d4179c503e8951a076ee077f7e420062f7ad2d46ee4fe7a3317121e7794fb4c99c40051be1b8633e95ce6d61d5b48ac1e13538042ca19eb3dc5add7
SSDEEP 24:s8ncR61iTCr8sipFNwfLkmXiMMTs9uoUEjztgw4:/cHT/si2fLP9MI9Cw4
TLSH
T1468275666DFECA102608FD36343BCBB0D1EA12794A149797E00D3F54C5048C9FA5C22D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Skalmuringen.man

SHA256 3bc5227800546b93cc8f851f23ba9fedafde70f87db70d938c881f19efca84f0
MD5 f3838d33f11b51f2688d906c5ec0a78b
SHA1 ea8ed95c65fa8f48bfd54031cee9da5086cc9419
SHA512 af68b4522553d69804e5c3e62af7ce662cc3b6b0982ddf64c3b0bbe6abaa6552a51290e035e36201801ad2d8e7c4c9c32ce953c7c0b982db252f2dede9a2f2b2
SSDEEP 96:4l8VWODvRU/LJJ1VkAJnIhM1ZmvwR+3Uv0JSdbdJgKPy7v:rVWOD50LjkWQM1MoR+20EsK67v
TLSH
T164731925301A5214945365F18F588D01117FB3BDC26156BFE41B1C6B9CDDBAB2D0E25F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

oprindelsens.bes

SHA256 77e7b4d416dc830f8ddf5cfd97cf5fe2599defbe5c93d8711788d47f8d9aea21
MD5 70b9467972e22f2a199a1b30080f35b7
SHA1 f549be15515d9a009b594b3157f022e27487cc35
SHA512 4f42f26fe811a296ad9021a9903dddc2032f0e5070df752b7af50be93a9068ec50b88f3c865086af56e8c1150bb3cd52ac9c7a673ae8510783c25c55eca6a00b
SSDEEP 24:Sg7AJA/TkKuGBkej0vCAh3cUAWi+wrdF6AaF4xuaz59r6ky365ZL28dE0sKf1qz:SgjTkKkewCAh3hAZxaAa2by3KCNUNqz
TLSH
T1FBD286C31E033E8E23B975C8787DFB5BA927AD875CF92681B3360855D146518B529C05
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

priests.bur

SHA256 35fedeb09e3c03f90bf46fd34fb553e61b1d7ec32a109a0bf2270b8171f00a18
MD5 33d1021e14c4dd760d5fe3b13de20932
SHA1 1d4bb75050bc6b484372b37bcd28913ae82821c6
SHA512 c79487507afcf1522ec04eb05967c19519a3c2bfc9c389edfafb63f38e78b21ade6cca773a1afd9a2d94a9e1c025493dfeea61aa4ef2477634e8d0bb916fecdb
SSDEEP 24:m0csiY1wr8eFpk96bdddd1Isqsy8kfNzFpBcVtvzXBdpBKCdeZkVsgbC:m0nQs6RWsGfP7cPb5BKCgmk
TLSH
T1C9534CC6C121514E494468B9AFCAA7CF24FC8FA20944E8AAD43CDDC2FDB0145C17E770
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

spinulation

SHA256 72dc5a4edf63aea34c28f64ddda8c07aef7de972de470ae676af544186353396
MD5 e070a814aed7b4efa59b7b1a139cfc1f
SHA1 65e94ded0d057296b6553850f77d8e0468179cbb
SHA512 32d879d99f73b91e559b4c62ac8ac9b4f7771de6aea900aacb2bdae8a154d8495a80a2b19d9f7e86000d1edadfc969d114c92ad8e22d52a8bbfba7a051e821f9
SSDEEP 3072:YgfLBiIuZiZxgjMJDBWP78vzbd2RjJd0r5XcCbHW6oBCvm5wMKc4gxJ:Y+r9D3MRtdYRW62Cv6zYuJ
TLSH
T161D3F1BC4AAFF2F3C3057FFBE167228A6DA93957B35AA1707E40A016996CF10454709C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Containeriserings

Lipogenic.fac

Skalmuringen.man

oprindelsens.bes

priests.bur

spinulation

Sharing

General

Malware Config

Signatures

File Explorer

2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Containeriserings

Lipogenic.fac

Skalmuringen.man

oprindelsens.bes

priests.bur

spinulation