AntarctidaBuilder[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AntarctidaBuilder.exe
Size 3.8MB
Sample260816-bme7qsxaqe
SHA256 509491c910da36d079d0833ad8a809722560c1495706af56b7f519d56ccafc48
MD5 5b3a938202871df64430c155a39375e6
SHA1 f26888d7c5a378a23deb527aa68e0cc27277bfa7
SHA512 04b6306c7d1e1e79111063ccca9463d0765a249781ce00b90b8225f989b2d58e6cdd2c71b42dfa354b5306226732e78a0e34d4f0ce82a72ff33fe7cfbf730528
SSDEEP 98304:izG07h6A9DIMZfouvU9ZeDHTkl8yU2QrJp2Y8b:hFI3UuD4fQKY8
TLSH
T1AB06331EE0D3998BC9376E32FCBDC153C68BAFA35267D6B1CC55C44615DFA86AA1000E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
AntarctidaBuilder.exe
unpack001/costura.dll
unpack001/dnlib.dll
unpack001/materialskin.dll
unpack001/obfuscator.dll
unpack001/rjcodeadvance.rjcontrols.dll

File Explorer

AntarctidaBuilder.exe

.exe 3.8MB
costura.dll

.dll 5KB
costura.pdb

7KB
dnlib.dll

.dll 1.1MB
materialskin.dll

.dll 6.4MB
obfuscator.dll

.dll 69KB
rjcodeadvance.rjcontrols.dll

.dll 39KB

AntarctidaBuilder.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 509491c910da36d079d0833ad8a809722560c1495706af56b7f519d56ccafc48
MD5 5b3a938202871df64430c155a39375e6
SHA1 f26888d7c5a378a23deb527aa68e0cc27277bfa7
SHA512 04b6306c7d1e1e79111063ccca9463d0765a249781ce00b90b8225f989b2d58e6cdd2c71b42dfa354b5306226732e78a0e34d4f0ce82a72ff33fe7cfbf730528
SSDEEP 98304:izG07h6A9DIMZfouvU9ZeDHTkl8yU2QrJp2Y8b:hFI3UuD4fQKY8
TLSH
T1AB06331EE0D3998BC9376E32FCBDC153C68BAFA35267D6B1CC55C44615DFA86AA1000E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3955870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\NotBabka\Desktop\Antarctida Stealer\AntarctidaBuilder\AntarctidaBuilder\obj\Release\AntarctidaBuilder.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
MD5 c087c70deb98db9d0b046d0a3d0e582a
SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
TLSH
T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1183806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

materialskin.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8885fc437c8b14c2fcbe04fddc6af6a86b63ed93175b0ee176da9aa93ec8e93e
MD5 082cffeded47ad0807a91a8731ff8f54
SHA1 e24d0c7c7f10d31f521347b2d697e23ddb3d1754
SHA512 81d89317c21cc6379cf1f84230249e9e7f87ac6bab3da1ee858672e63f94f65ddc7cd8f48e917df71f082868f37e87d5acaed96736cb60dfafe2396f7dd67e67
SSDEEP 98304:JDvd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uN4E:J6Kv8XcXD4K
TLSH
T158662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3184CA944EC69BBC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6747710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Mes Documents\VS Projects\MaterialSkin\_release\MaterialSkin-2.3.1\MaterialSkin\obj\Release\net48\win\MaterialSkin.pdb

obfuscator.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 efe9ad63fc51292d7a80afbd6efeff8ad70883ab7a3955fe3c00aebbbb873474
MD5 446fd551d2f5b54be4b3d91d210a872e
SHA1 441d13b0a4d028ae3df0e48e0e7e0e1a6ed9b0c2
SHA512 31db972def78e0719ee1d0c61ddc0facc6d028223838d3544910e15c583f6a6958f66fafa90671cc90464b8ce34943e26f4c6d1cfdf9a7097a4ac6b3b9c5c941
SSDEEP 1536:r+a3s60J6VafbX61ssuiGNOpTDjc2B9osDNDCQ/DDyYKQ+I8XFPUuLX5kVrIduu1:r+a3s60J6VafbX61ssuiGNOpTDjc2B9o
TLSH
T14E63E5052794CF27C1FDAA7532A9521856F0CA3A5713F7DA2CC7B5E62CD73848B082E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Malware\source\repos\MadXmrig\Libs\Obfuscator\obj\Release\Obfuscator.pdb

rjcodeadvance.rjcontrols.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 901f996e7705dc069fd18040283aa979246f793b03c48194c4dbe9c1465074cf
MD5 037a48cec62e575ffdbca2560e9db6fb
SHA1 cfb9e175630f972bb38ffdc5ac596937affc8ce7
SHA512 1b42d3720ae00548c89b3e8c53a5d0b94c0643c1a209f49bda1ce4257fb014cf4d455d7d1aeb87ce9295f2b60d8aae28b793a4e4bccc3111bf281ec43f860c04
SSDEEP 768:skW1TSkz4rnMDRHT/u3mgBUTa+UE6vs5l/T6:jWRSkzAMDRH5+E6a/T6
TLSH
T10003295D62AD961FC03E0FFDE4E184106375A365B9ABE75C9FC620AD6CA7360CA20347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\RJ Code Advance\Source Code C#\2021\CustomControls\CustomControls\obj\Debug\RJCodeAdvance.RJControls.pdb

AntarctidaBuilder.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

dnlib.dll

mscoree

dotnet

materialskin.dll

mscoree

dotnet

obfuscator.dll

mscoree

dotnet

rjcodeadvance.rjcontrols.dll

mscoree

dotnet