nightledger | 24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9

Resubmissions

19/08/2026, 16:53

260819-vec7ysycrc10

14/08/2026, 17:08

260814-vnkndseq2s10

Sharing

Copy URL Twitter E-mail

General

Target
24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9
Size 1.1MB
Sample260814-vnkndseq2s
SHA256 24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9
MD5 a239e655709a2518dd0b7bdbed163679
SHA1 79f3ef6c6127edb0a5f43ef7a16bfb3418860e19
SHA512 6e30e44f776225c37176831afc229fd96bbcd22f893592d861e53a9e2800d5380f7e274a5e293eb7e965e00e6cb724990385f419be3ce5079cc7653f965a6498
SSDEEP 24576:JoFW1Q4DFEDUPjvCO8yhGJbvoj7VVg0Afa61lnNd4R9kOPMKjLTNgRz/tMH3NQPw:JoFW24Dyora5AMvoj7c0bPbkOPMUNgRN
TLSH
T1DC359D0ABA8E10F4C5A9D0B886979512FB75385A5931FFDF46D422662F37FA01F2B304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt mirage_kitten unc_1549 backdoor nightledger

Malware Config

Extracted

Family

nightledger

realhealthshop.com
tjconsultingservices.com

Signatures

Family: NightLedger
NightLedger is a Windows backdoor attributed to Iran-nexus actors MIRAGE KITTEN aka UNC1549.
backdoor nightledger

Detects NightLedger Backdoor 1 IoCs

apt mirage_kitten unc_1549

resource	yara_rule
sample	family_nightLedger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9

File Explorer

24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9

.dll 1.1MB

24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9

IMPHASH 469853fbedc63940aec84f114436966f
SHA256 24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9
MD5 a239e655709a2518dd0b7bdbed163679
SHA1 79f3ef6c6127edb0a5f43ef7a16bfb3418860e19
SHA512 6e30e44f776225c37176831afc229fd96bbcd22f893592d861e53a9e2800d5380f7e274a5e293eb7e965e00e6cb724990385f419be3ce5079cc7653f965a6498
SSDEEP 24576:JoFW1Q4DFEDUPjvCO8yhGJbvoj7VVg0Afa61lnNd4R9kOPMKjLTNgRz/tMH3NQPw:JoFW24Dyora5AMvoj7c0bPbkOPMUNgRN
TLSH
T1DC359D0ABA8E10F4C5A9D0B886979512FB75385A5931FFDF46D422662F37FA01F2B304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects NightLedger Backdoor

apt mirage_kitten unc_1549
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

598188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC DeleteObject GetDeviceCaps

gdiplus

GdiplusShutdown GdipGetImageEncodersSize GdipGetImageEncoders GdipCloneImage GdipFree GdipDisposeImage GdiplusStartup GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipAlloc

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

user32

GetDC ShowWindow ReleaseDC

kernel32

WriteConsoleW CreateFileW HeapSize SetStdHandle HeapReAlloc GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FlushFileBuffers ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP WriteFile GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID GetCurrentProcess GetLastError FormatMessageW LocalFree GlobalSize GlobalLock GlobalUnlock LoadLibraryW GetProcAddress GetCurrentThreadId GetLogicalDrives Sleep LoadLibraryA CloseHandle GetFileSizeEx SetFilePointerEx GetConsoleWindow CreateThreadpoolWork SubmitThreadpoolWork CreateMutexW ExitProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLocaleInfoEx WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo IsValidLocale RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind

AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA AddSecurityPackageW ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CompleteAuthToken CredMarshalTargetInfo CredUnmarshalTargetInfo DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext FreeContextBuffer FreeCredentialsHandle GetSecurityUserInfo GetUserNameExA GetUserNameExW ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW LogonUserExExW LsaCallAuthenticationPackage LsaConnectLocalUser LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaSetMachineCertificate LsaUnregisterPolicyChangeNotification MakeSignature QueryContextAttributesA QueryContextAttributesExA QueryContextAttributesExW QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesExA QueryCredentialsAttributesExW QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SecAllocateAndSetCallTarget SecAllocateAndSetIPAddress SecCacheSspiPackages SecDeleteUserModeContext SecFreeCallContext SecInitUserModeContext SeciAllocateAndSetCallFlags SeciAllocateAndSetCallTarget SeciAllocateAndSetIPAddress SeciFreeCallContext SeciIsProtectedUser SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiDecryptAuthIdentityEx SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiEncryptAuthIdentityEx SspiExcludePackage SspiFreeAuthIdentity SspiGetComputerNameForSPN SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiSetChannelBindingFlags SspiUnmarshalAuthIdentity SspiUnmarshalAuthIdentityInternal SspiValidateAuthIdentity SspiZeroAuthIdentity UnsealMessage VerifySignature