6a4b9d67c109e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6a4b9d67c109e.exe
Size 6.6MB
Sample260803-tpryesca42
SHA256 edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868
MD5 dca6afeddc135645ec068160a47c9510
SHA1 54c5c2659e3af3aca44fa046fb366cd32f5ed387
SHA512 e6f16736acba789d0bb00fe7f1e8a123bee7fee8eff03fa5df8fca32cdce3df2593cac0fe226b2ac37d9f69b3812c8652a1fba5dd37220019256034d88e463c2
SSDEEP 98304:Fa7im/aOxHSGYKOKaPuWn0yMxnTq0dKtxaEe+5HX9iOEtYsJw:Fa7fauH/NOKaP30dlTps28XQD+si
TLSH
T185668D2F611403ECC86DC63984CF2199F56035685338AFEFB2905B211FB6AE46FB9647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6a4b9d67c109e.exe
unpack001/costura.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/guna.ui2.dll

File Explorer

6a4b9d67c109e.exe

.exe 6.6MB
costura.dll

.dll 5KB
costura.pdb

7KB
guna.ui2.dll

.dll 2.1MB

6a4b9d67c109e.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868
MD5 dca6afeddc135645ec068160a47c9510
SHA1 54c5c2659e3af3aca44fa046fb366cd32f5ed387
SHA512 e6f16736acba789d0bb00fe7f1e8a123bee7fee8eff03fa5df8fca32cdce3df2593cac0fe226b2ac37d9f69b3812c8652a1fba5dd37220019256034d88e463c2
SSDEEP 98304:Fa7im/aOxHSGYKOKaPuWn0yMxnTq0dKtxaEe+5HX9iOEtYsJw:Fa7fauH/NOKaP30dlTps28XQD+si
TLSH
T185668D2F611403ECC86DC63984CF2199F56035685338AFEFB2905B211FB6AE46FB9647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6975198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Syntex Spoofer.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

Major OS version

Entry point

2188926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

6a4b9d67c109e.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet