AntarctidaBuilder[.]exe

Resubmissions

09/08/2026, 17:13

260809-vrv9asselb

09/08/2026, 17:11

260809-vqbs9saq214

Sharing

Copy URL Twitter E-mail

General

Target
AntarctidaBuilder.exe
Size 3.9MB
Sample260809-vqbs9saq21
SHA256 f896102bf4a5c6cd265be315eec0c5ed82d68772059f4e733185601d0fe233fb
MD5 e0ee73c5aa4f52b96cd56e629c4c9e09
SHA1 5a243173676f0d602fbd072730856f77a8509df2
SHA512 75b299d6470d9dd2eb44293003965b3aa6e16f5d9c5fd4b3f443201fa299853f897d48ff4c1afebf672dc33102b3bd81d858ff293fcb65685bb443c843a527d9
SSDEEP 98304:/0ObzG07h6A9DIMZfouvU9ZeDHTkl8yU2QrJp2Y8b:8dFI3UuD4fQKY8
TLSH
T15816331FE4E3958BC9336E31FC79C153C68BAFE75217D7A2CC95C44A159FA86AA1000E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
AntarctidaBuilder.exe
unpack001/costura.dll
unpack001/dnlib.dll
unpack001/materialskin.dll
unpack001/obfuscator.dll
unpack001/rjcodeadvance.rjcontrols.dll

File Explorer

AntarctidaBuilder.exe

.exe 3.9MB
costura.dll

.dll 5KB
costura.pdb

7KB
dnlib.dll

.dll 1.1MB
materialskin.dll

.dll 6.4MB
obfuscator.dll

.dll 69KB
rjcodeadvance.rjcontrols.dll

.dll 39KB

AntarctidaBuilder.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f896102bf4a5c6cd265be315eec0c5ed82d68772059f4e733185601d0fe233fb
MD5 e0ee73c5aa4f52b96cd56e629c4c9e09
SHA1 5a243173676f0d602fbd072730856f77a8509df2
SHA512 75b299d6470d9dd2eb44293003965b3aa6e16f5d9c5fd4b3f443201fa299853f897d48ff4c1afebf672dc33102b3bd81d858ff293fcb65685bb443c843a527d9
SSDEEP 98304:/0ObzG07h6A9DIMZfouvU9ZeDHTkl8yU2QrJp2Y8b:8dFI3UuD4fQKY8
TLSH
T15816331FE4E3958BC9336E31FC79C153C68BAFE75217D7A2CC95C44A159FA86AA1000E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4074990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\NotBabka\Desktop\Antarctida Stealer\AntarctidaBuilder\AntarctidaBuilder\obj\Release\AntarctidaBuilder.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
MD5 c087c70deb98db9d0b046d0a3d0e582a
SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
TLSH
T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1183806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

materialskin.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8885fc437c8b14c2fcbe04fddc6af6a86b63ed93175b0ee176da9aa93ec8e93e
MD5 082cffeded47ad0807a91a8731ff8f54
SHA1 e24d0c7c7f10d31f521347b2d697e23ddb3d1754
SHA512 81d89317c21cc6379cf1f84230249e9e7f87ac6bab3da1ee858672e63f94f65ddc7cd8f48e917df71f082868f37e87d5acaed96736cb60dfafe2396f7dd67e67
SSDEEP 98304:JDvd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uN4E:J6Kv8XcXD4K
TLSH
T158662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3184CA944EC69BBC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6747710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Mes Documents\VS Projects\MaterialSkin\_release\MaterialSkin-2.3.1\MaterialSkin\obj\Release\net48\win\MaterialSkin.pdb

obfuscator.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 efe9ad63fc51292d7a80afbd6efeff8ad70883ab7a3955fe3c00aebbbb873474
MD5 446fd551d2f5b54be4b3d91d210a872e
SHA1 441d13b0a4d028ae3df0e48e0e7e0e1a6ed9b0c2
SHA512 31db972def78e0719ee1d0c61ddc0facc6d028223838d3544910e15c583f6a6958f66fafa90671cc90464b8ce34943e26f4c6d1cfdf9a7097a4ac6b3b9c5c941
SSDEEP 1536:r+a3s60J6VafbX61ssuiGNOpTDjc2B9osDNDCQ/DDyYKQ+I8XFPUuLX5kVrIduu1:r+a3s60J6VafbX61ssuiGNOpTDjc2B9o
TLSH
T14E63E5052794CF27C1FDAA7532A9521856F0CA3A5713F7DA2CC7B5E62CD73848B082E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Malware\source\repos\MadXmrig\Libs\Obfuscator\obj\Release\Obfuscator.pdb

rjcodeadvance.rjcontrols.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 901f996e7705dc069fd18040283aa979246f793b03c48194c4dbe9c1465074cf
MD5 037a48cec62e575ffdbca2560e9db6fb
SHA1 cfb9e175630f972bb38ffdc5ac596937affc8ce7
SHA512 1b42d3720ae00548c89b3e8c53a5d0b94c0643c1a209f49bda1ce4257fb014cf4d455d7d1aeb87ce9295f2b60d8aae28b793a4e4bccc3111bf281ec43f860c04
SSDEEP 768:skW1TSkz4rnMDRHT/u3mgBUTa+UE6vs5l/T6:jWRSkzAMDRH5+E6a/T6
TLSH
T10003295D62AD961FC03E0FFDE4E184106375A365B9ABE75C9FC620AD6CA7360CA20347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\RJ Code Advance\Source Code C#\2021\CustomControls\CustomControls\obj\Debug\RJCodeAdvance.RJControls.pdb

AntarctidaBuilder.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

dnlib.dll

mscoree

dotnet

materialskin.dll

mscoree

dotnet

obfuscator.dll

mscoree

dotnet

rjcodeadvance.rjcontrols.dll

mscoree

dotnet