Froststrap-Setup (1)[.]exe

Resubmissions

15/08/2026, 23:27

260815-3fqhnswvcs8

15/08/2026, 23:23

260815-3dbxhawthy8

Sharing

Copy URL Twitter E-mail

General

Target
Froststrap-Setup (1).exe
Size 22.7MB
Sample260815-3dbxhawthy
SHA256 42df3cca6e1b38b5fa0cfe08523b57afaba1be51ae0313e36ca93496bff30561
MD5 e8b0bc836830f6ca22a5ce9ef52745e0
SHA1 61fd53f97901b3ae61817f62f88bfd98a31dcbc2
SHA512 44a55ba3b895f87b1258351aedbd7984325ba4ed12b122598a3a1bc1709aebad05c6645b940daad90437e1bd5af6fdb896d71871617d9ef0f7c1c95d95570973
SSDEEP 393216:YjKxeMnvqZdQoiy6afQlseNxI3Tc63AI/YUaQ5LKvyilMaiO6Ujd5LwimzOy0oD0:K2nvqZdQfy6LyF/YUaQwRlMJYd2imKH
TLSH
T176373309D14361B7E2FBC6B263CBD0841AB518397720D405DA0BCD9E1AB66DBFEBE414
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
Froststrap-Setup (1).exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Froststrap.exe

File Explorer

Froststrap-Setup (1).exe

.exe 22.7MB
$PLUGINSDIR/System.dll

.dll 29KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 14KB
Froststrap.exe

.exe 62.0MB

Froststrap-Setup (1).exe

IMPHASH a46ac714274c7f150eaa703de6d7fb57
SHA256 42df3cca6e1b38b5fa0cfe08523b57afaba1be51ae0313e36ca93496bff30561
MD5 e8b0bc836830f6ca22a5ce9ef52745e0
SHA1 61fd53f97901b3ae61817f62f88bfd98a31dcbc2
SHA512 44a55ba3b895f87b1258351aedbd7984325ba4ed12b122598a3a1bc1709aebad05c6645b940daad90437e1bd5af6fdb896d71871617d9ef0f7c1c95d95570973
SSDEEP 393216:YjKxeMnvqZdQoiy6afQlseNxI3Tc63AI/YUaQ5LKvyilMaiO6Ujd5LwimzOy0oD0:K2nvqZdQfy6LyF/YUaQwRlMJYd2imKH
TLSH
T176373309D14361B7E2FBC6B263CBD0841AB518397720D405DA0BCD9E1AB66DBFEBE414
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetAsyncKeyState GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW wvsprintfW

Name

.text

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH b844086d4b3e59aa7b4439d88bcb40cb
SHA256 a659985eb1c12d6eade4c2c9d4e48f5748c9f2afa942a8934034c2c622db050a
MD5 5b0afb184846e9909fb478040da01557
SHA1 08a8896ae10480988ae5af9b38f5283d278ce6f5
SHA512 e12aad20aa652c8b31de57ca291b6bf51491b58a2d717b510cab1a421c16585e1d7e9f3a04059249ad615cb4df5ce0b3d17cd15d8c8ad37798c542c98df9ddcd
SSDEEP 384:Ichls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwHnY9py2ediASIo:ImHckOVih+S/Fxq7v4HnYeoASIo
TLSH
T1E0D22929FF0BC8B2D1B655F049DFFB77482A790547225E6BEE168D08BC33A139A19107
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH c442f1649aa0670a32c622fadfcd00bd
SHA256 044077656d92a24ca83e479a6c65143316e9a5d11e772ec54e9fc7d872a227d7
MD5 acfde3d077386ed16db79956d9e29ffa
SHA1 bd578f2315d397874d12f4542ff3cb6571a6f8f5
SHA512 408d251ebfdc9c3cab9d0beb61506e45910f8fef7493548dd05f6df59c1604ec8ed604070e7e595a2f7034878e12242745c428d285a0cc80513c82df51a277a8
SSDEEP 384:KqWL5JCYXh2OPxv9OIR6oYkvLlwgS+3X9jN:KqXG2cLR9v6gzNjN
TLSH
T13652C50DFB1B14FAC571D974958BFB3F8A9DA415C66B4E06EF160B0CBD922B1680E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Froststrap.exe

IMPHASH 53e4e12437621212a425d294842d0a96
SHA256 633a5f4441aa0131bdff666a3316740931d68f31d9e5a72781d61687634d40ce
MD5 f5d607a2ae30aeb00a3e32503eeb170e
SHA1 02150b7e2c09e068d7bdebbe23203a11c6134911
SHA512 c02a66c8e78ad43e5458bde32818818ac61b797442af605a9f7a7b4f807a60166320608fc83c19fc5c195ffc7b081d9d171df0ae4c4503176a6969608298f247
SSDEEP 393216:5JzsQJkhsuJ8XbJzJoGOPGnsw5lQNsAGUipol1DVjgjfm4qb0:z9M8Vt0xwrQWpfTm4U0
TLSH
T14AE79D11B3E84A6DD47F923496B2000656B0BC5A5720E7CF3A8C75ED1F72BC06E76B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW GetCurrentProcessId TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

Froststrap-Setup (1).exe

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

comdlg32

gdi32

kernel32

ole32

shell32

user32

generic

Froststrap.exe

shell32

advapi32

kernel32

user32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

generic