FSRealistic-Plus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FSRealistic-Plus.exe
Size 2.9MB
Sample260802-th713acd49
SHA256 6577ddfec2cba5e2d60e4028098ddac9b3b847819f46079c1c4ed82a9020d232
MD5 98d3f0cf4a7fc05750ecbf22a02c7266
SHA1 45a2ac3506053f9622d3491ebb0358ff0eb2bcbf
SHA512 7a5aa21031730303af64263843844a0b3eb1ad902826e422c9cb4e3458dcf26e9052da87b9ed0216fb88f2053828525f535f3ee5a865c8aef77352ebd0adfff1
SSDEEP 24576:be1DPGLuKxjFq2lgag7GZYo91KJ7Z1/5rivMO+H8HHzAwePqvJDQTglckyPP:6RH2lgaqo9Q/1/5rivCH8HHJS
TLSH
T1D9E5D625C3140D6CE0BED2B499F60557F2A4374B06E5568B3FBCCE4C5F73292BA26826
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FSRealistic-Plus.exe

File Explorer

FSRealistic-Plus.exe

.exe 2.9MB

FSRealistic-Plus.exe

IMPHASH 24810887e09af0823f9ab99c54f9a048
SHA256 6577ddfec2cba5e2d60e4028098ddac9b3b847819f46079c1c4ed82a9020d232
MD5 98d3f0cf4a7fc05750ecbf22a02c7266
SHA1 45a2ac3506053f9622d3491ebb0358ff0eb2bcbf
SHA512 7a5aa21031730303af64263843844a0b3eb1ad902826e422c9cb4e3458dcf26e9052da87b9ed0216fb88f2053828525f535f3ee5a865c8aef77352ebd0adfff1
SSDEEP 24576:be1DPGLuKxjFq2lgag7GZYo91KJ7Z1/5rivMO+H8HHzAwePqvJDQTglckyPP:6RH2lgaqo9Q/1/5rivCH8HHJS
TLSH
T1D9E5D625C3140D6CE0BED2B499F60557F2A4374B06E5568B3FBCCE4C5F73292BA26826
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

valamiamerika123

Minor OS version

Major OS version

Entry point

3039232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegQueryValueExW CryptReleaseContext RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegQueryValueExA RegOpenKeyExA CryptAcquireContextA

comdlg32

GetOpenFileNameW

crypt32

CertEnumCertificatesInStore CryptProtectData CertFreeCertificateContext CertOpenSystemStoreW CryptUnprotectData CertCloseStore

iphlpapi

GetAdaptersInfo

kernel32

RtlLookupFunctionEntry WakeAllConditionVariable AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW CancelIo BindIoCompletionCallback WaitNamedPipeA GetPrivateProfileSectionA GetPrivateProfileStringA lstrcmpiA GetModuleHandleExA GetModuleHandleA SetEvent DeleteCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileA GetCurrentDirectoryA QueryPerformanceCounter GetFileSize GetSystemTimeAsFileTime CreateThread CreateEventW SetConsoleCtrlHandler GetModuleFileNameW FlushFileBuffers MoveFileExW SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetProcAddress RaiseException GetCurrentThreadId SetErrorMode TerminateProcess GetCurrentProcess RtlCaptureContext GetTempPathW DeviceIoControl GetTickCount CreateEventA Sleep ReleaseMutex CreateMutexA GetLocalTime OutputDebugStringW MoveFileW WideCharToMultiByte CopyFileW CreateProcessW ExitProcess CloseHandle DeleteFileW GetLastError GetTickCount64 GetFileAttributesW CreateFileW WaitForSingleObject FindClose RemoveDirectoryW WriteFile FindNextFileW GetFileSizeEx FindFirstFileW ReadFile CreateDirectoryW LoadResource LockResource FindResourceA SizeofResource MultiByteToWideChar InitializeSListHead LocalFree LeaveCriticalSection

kernelbase

InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW

ntdll

LdrControlFlowGuardEnforced

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_function_call@std@@YAXXZ ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ __set_stl_sync_api_mode __set_stl_sync_api_mode __crtIsPackagedApp ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z __crtIsPackagedApp __set_stl_sync_api_mode ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1time_base@std@@UEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_lock _Thrd_id _Mtx_unlock ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_join ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z _Mtx_trylock ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

openal32

alBufferData alDeleteBuffers alDeleteSources alDistanceModel alGenBuffers alGenSources alGetError alGetListener3f alGetProcAddress alGetSource3f alGetSourcef alGetSourcei alListener3f alListenerf alListenerfv alSource3f alSource3i alSourcePause alSourcePlay alSourceQueueBuffers alSourceRewind alSourceStop alSourceUnqueueBuffers alSourcef alSourcei alcCloseDevice alcCreateContext alcDestroyContext alcGetIntegerv alcGetString alcIsExtensionPresent alcMakeContextCurrent alcOpenDevice

shell32

SHGetKnownFolderPath SHGetFolderPathA ShellExecuteW

shlwapi

PathCombineA

user32

DefWindowProcW GetForegroundWindow GetWindowTextA PostMessageA DispatchMessageA CreateWindowExW RegisterClassW TranslateMessage PeekMessageA GetAsyncKeyState GetCursorPos

vcruntime140

memcmp _CxxThrowException memset memcpy _set_purecall_handler __std_exception_destroy __std_exception_copy __std_terminate _purecall memmove __current_exception __current_exception_context __C_specific_handler strchr

vcruntime140_1

__CxxFrameHandler4

wininet

InternetGetConnectedState InternetCloseHandle HttpQueryInfoW InternetSetOptionW InternetOpenW InternetOpenUrlW

ws2_32

__WSAFDIsSet WSACleanup WSASocketW shutdown select htons listen bind accept WSARecv WSASend inet_pton WSAStartup WSAGetLastError closesocket setsockopt getpeername getnameinfo ioctlsocket getaddrinfo getsockname freeaddrinfo getsockopt send recv socket connect ntohs

ucrtbase

strtoul strtold strtoll strtoumax wcstombs_s strtol atol _wgetenv realloc free _callnewh _set_new_mode malloc _configthreadlocale localeconv sqrtf sqrt sinf sin pow logf fmodf fmod floorf floor expf exp cosf cos _ldclass __setusermatherr ceilf ldexp _ldsign round tanh _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _c_exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo_noreturn terminate _beginthreadex _wassert _invoke_watson _set_abort_behavior _register_thread_local_exe_atexit_callback _errno signal _set_invalid_parameter_handler set_terminate abort exit system fread fwrite __stdio_common_vsnprintf_s ftell __p__commode fseek __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsprintf _set_fmode fclose __acrt_iob_func fgetc fputc isalpha strncmp isalnum tolower isspace toupper isdigit _time64 clock qsort srand rand

dbgcore

MiniDumpWriteDump

libcrypto-3-x64

EVP_DigestVerifyFinal BIO_new_mem_buf EVP_PKEY_CTX_set_rsa_padding BIO_read EVP_DigestVerifyInit X509_NAME_get_text_by_NID EVP_MD_CTX_new d2i_X509 BIO_ctrl BIO_f_base64 BIO_push X509_STORE_add_cert OPENSSL_sk_value BIO_set_flags EVP_md5 BIO_new EVP_PKEY_CTX_set_rsa_pss_saltlen EVP_DigestFinal_ex ASN1_STRING_get0_data EVP_sha512 BIO_new_socket BIO_free EVP_sha256 EVP_DigestUpdate PEM_read_bio_PUBKEY GENERAL_NAMES_free EVP_MD_CTX_free EVP_DigestInit_ex EVP_PKEY_free BIO_free_all X509_STORE_free X509_free ASN1_STRING_length X509_get_subject_name EVP_DigestVerifyUpdate X509_get_ext_d2i OPENSSL_sk_num

libcurl

curl_easy_perform curl_easy_setopt curl_easy_init curl_global_init curl_easy_getinfo curl_easy_strerror curl_easy_cleanup

libssl-3-x64

SSL_peek SSL_connect OPENSSL_init_ssl SSL_free SSL_CTX_get_cert_store SSL_CTX_set_default_verify_paths SSL_new SSL_CTX_free SSL_CTX_set_cert_store SSL_CTX_use_certificate_file SSL_CTX_use_PrivateKey_file SSL_CTX_new SSL_write SSL_get_verify_result TLS_client_method SSL_ctrl SSL_get_error SSL_shutdown SSL_get1_peer_certificate SSL_CTX_load_verify_locations SSL_set_verify SSL_read SSL_pending SSL_set_bio

libvorbis

vorbis_info_clear vorbis_analysis vorbis_analysis_blockout vorbis_dsp_clear vorbis_comment_clear vorbis_comment_init vorbis_analysis_buffer vorbis_analysis_wrote vorbis_info_init vorbis_encode_init_vbr vorbis_bitrate_addblock vorbis_analysis_init vorbis_comment_add_tag vorbis_bitrate_flushpacket vorbis_analysis_headerout vorbis_block_init vorbis_block_clear

combase

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata2

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata2

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.entry

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FSRealistic-Plus.exe

advapi32

comdlg32

crypt32

iphlpapi

kernel32

kernelbase

ntdll

msvcp140

openal32

shell32

shlwapi

user32

vcruntime140

vcruntime140_1

wininet

ws2_32

ucrtbase

dbgcore

libcrypto-3-x64

libcurl

libssl-3-x64

libvorbis

combase

generic