softether-vpnclient-v4[.]44-9807-rtm-2025[.]04[.]16-windows-x86_x64-intel[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
Size 53.6MB
Sample260809-3cbkcaxcph
SHA256 ab006331f1f646bc319585088239d55bc54ecde5c269009268e9598307da7a44
MD5 002322a3adc9b1b9a8c35492624ec604
SHA1 6f23bcc3bfb585c516634071d59e2a68f90c2f20
SHA512 b649fc91029ede360fa90736a09a1dbe8f8f95629b230f8af7f885e31f2498b1dd4d68883419f7b39a67f0b0a6bef9c3eb75fc67a5b03e90a64dc2408ab8560f
SSDEEP 1572864:HBy/3Ry2m3TclE78TZnmMFn9ePG6A++UDA6n5UI6l:hy/3I2mgy78TZh0PGM5AS+
TLSH
T122C72301FB418064E88240F6A3BB4B7E6D78AB20730951C3D7D1BEB5BA396D1793935E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe

.exe 53.6MB

softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe

IMPHASH 2d1ff19bd1cfdd1f1131994955b17ea8
SHA256 ab006331f1f646bc319585088239d55bc54ecde5c269009268e9598307da7a44
MD5 002322a3adc9b1b9a8c35492624ec604
SHA1 6f23bcc3bfb585c516634071d59e2a68f90c2f20
SHA512 b649fc91029ede360fa90736a09a1dbe8f8f95629b230f8af7f885e31f2498b1dd4d68883419f7b39a67f0b0a6bef9c3eb75fc67a5b03e90a64dc2408ab8560f
SSDEEP 1572864:HBy/3Ry2m3TclE78TZnmMFn9ePG6A++UDA6n5UI6l:hy/3I2mgy78TZh0PGM5AS+
TLSH
T122C72301FB418064E88240F6A3BB4B7E6D78AB20730951C3D7D1BEB5BA396D1793935E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

fc:d5:d6:e9:f9:05:a0:b7:55:e5:8e:22:a5:be:90:07:2e:5c:a8:31:49:86:08:94:b6:bc:b3:b0:f0:26:96:60

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Apr 15, 2025

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

b0:f4:cb:60:91:2c:09:9e:3f:17:3d:81:48:f2:41:31:d8:48:7e:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Apr 15, 2025

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

SERIALNUMBER=0500-01-016519,CN=SOFTETHER CORPORATION,O=SOFTETHER CORPORATION,ST=Ibaraki,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Serial Number

e2:2b:42:75:b0:e5:1d:4b:a3:16:d7:c5:7a:fb:8e:fd

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2024 - Sep 11, 2027

Minor OS version

Major OS version

Entry point

4297867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tmp\softether_build_dir\Main\DebugFiles\pdb\Win32_Release\vpnsetup.pdb

kernel32

GetVersionExA CreateEventA GetLocalTime lstrlenA GetSystemDirectoryA GetExitCodeProcess GetUserDefaultLCID GetSystemDefaultLCID GetComputerNameW PulseEvent ReleaseMutex SetErrorMode QueryPerformanceFrequency QueryPerformanceCounter CreateFileW CreateDirectoryW CreateDirectoryA RemoveDirectoryW RemoveDirectoryA DeleteFileW DeleteFileA GetFileAttributesW GetFileAttributesA FreeResource LoadLibraryExA LoadLibraryExW SetFileAttributesA SetFileAttributesW GetComputerNameA LocalFree GetCurrentProcess GetThreadLocale SetConsoleScreenBufferSize GetConsoleScreenBufferInfo GetStdHandle LoadLibraryW GetShortPathNameA GetShortPathNameW TerminateProcess OpenProcess SetThreadAffinityMask GetCurrentThread SetEvent lstrcmpiA GetCurrentProcessId SetThreadPriority FindClose FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW GetTempPathW GetTempPathA SetUnhandledExceptionFilter GetModuleFileNameW GetModuleFileNameA GetCommandLineW GetCommandLineA WaitForMultipleObjects SystemTimeToFileTime GetSystemTime GetTimeZoneInformation HeapFree GetProcessHeap RaiseException GetDiskFreeSpaceExW GetDiskFreeSpaceExA FileTimeToSystemTime GetCurrentDirectoryW GetCurrentDirectoryA Sleep GlobalMemoryStatus SetPriorityClass GetSystemInfo CreateProcessW CreateProcessA MoveFileA SetFilePointer GetFileSize EnumResourceNamesA SetFileTime HeapCreate InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection ResetEvent ReadConsoleA ReadConsoleW WriteConsoleA WriteConsoleW SetLastError InitializeCriticalSectionAndSpinCount InterlockedCompareExchange TlsFree InterlockedExchangeAdd GetModuleHandleW GetVersion MultiByteToWideChar GetFileType FormatMessageA VirtualFree VirtualAlloc WideCharToMultiByte GetACP GetEnvironmentVariableW GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode CreateFileA GetLastError DeviceIoControl OpenEventA ReadFile WriteFile MoveFileW TlsAlloc GetCurrentThreadId MulDiv GetModuleHandleA WaitForSingleObject CreateMutexA OpenMutexA TlsSetValue TlsGetValue GetDriveTypeA FlushFileBuffers CloseHandle ReadConsoleInputA SetEndOfFile GetConsoleOutputCP SetEnvironmentVariableW SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW LCMapStringW LCMapStringA SetStdHandle GetFullPathNameA HeapSize GetConsoleCP GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA IsValidCodePage GetOEMCP GetCPInfo IsDebuggerPresent UnhandledExceptionFilter GetTickCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetConsoleCtrlHandler FileTimeToLocalFileTime CreateThread ExitThread RtlUnwind GetStartupInfoA InterlockedExchange LocalAlloc FindResourceA LoadResource SizeofResource LockResource LoadLibraryA GetProcAddress FreeLibrary GetFileInformationByHandle ExitProcess

gdi32

GetDeviceCaps GetTextMetricsA GetTextExtentPoint32A SelectObject CreateDIBSection BitBlt GdiFlush DeleteObject GetObjectA CreateCompatibleDC DeleteDC GetStockObject CreateFontA

comdlg32

GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW GetOpenFileNameA

shell32

Shell_NotifyIconW Shell_NotifyIconA SHGetSpecialFolderLocation ShellExecuteW SHGetPathFromIDListW SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA ShellExecuteExW ShellExecuteExA SHBrowseForFolderW SHChangeNotify

ole32

CoCreateGuid CoUninitialize CoInitialize PropVariantClear CoCreateInstance

oleaut32

SysAllocString SysFreeString

ws2_32

send recv htonl bind htons setsockopt sendto shutdown accept socket closesocket WSACleanup WSAStartup WSAEventSelect WSAIoctl WSAAccept WSAGetLastError ntohs listen connect getsockopt getsockname getpeername gethostname WSASetLastError inet_ntoa getservbyname inet_addr select ioctlsocket getservbyport gethostbyaddr recvfrom gethostbyname

comctl32

PropertySheetW ImageList_ReplaceIcon ImageList_SetBkColor ImageList_Create ImageList_Destroy CreateStatusWindowW InitCommonControlsEx CreatePropertySheetPageW

shlwapi

SHStrDupW

Sharing

General

Malware Config

Signatures

File Explorer

softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe

kernel32

gdi32

comdlg32

shell32

ole32

oleaut32

ws2_32

comctl32

shlwapi

generic