Overview
overview
7Static
static
3NidQrForm-SETUP 3.exe
windows10-2004-x64
7NidQrForm-SETUP 3.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/app-32.7z
windows10-2004-x64
1$PLUGINSDIR/app-32.7z
windows11-ltsc_2024-x64
1LICENSE.electron.txt
windows10-2004-x64
1LICENSE.electron.txt
windows11-ltsc_2024-x64
1blink_imag...nt.pak
windows10-2004-x64
3blink_imag...nt.pak
windows11-ltsc_2024-x64
3content_re...nt.pak
windows10-2004-x64
3content_re...nt.pak
windows11-ltsc_2024-x64
3icudtl.dat
windows10-2004-x64
3icudtl.dat
windows11-ltsc_2024-x64
3locales/am.pak
windows10-2004-x64
3locales/am.pak
windows11-ltsc_2024-x64
3locales/ar.pak
windows10-2004-x64
3locales/ar.pak
windows11-ltsc_2024-x64
3locales/bg.pak
windows10-2004-x64
3locales/bg.pak
windows11-ltsc_2024-x64
3locales/bn.pak
windows10-2004-x64
3locales/bn.pak
windows11-ltsc_2024-x64
3locales/ca.pak
windows10-2004-x64
3locales/ca.pak
windows11-ltsc_2024-x64
3locales/cs.pak
windows10-2004-x64
3locales/cs.pak
windows11-ltsc_2024-x64
3locales/da.pak
windows10-2004-x64
3locales/da.pak
windows11-ltsc_2024-x64
3General
- Target NidQrForm-SETUP 3.exe
- Size 27.6MB
- Sample260828-tnn55sdf44
- SHA256 85fd01ab2e73dd7baebcb9a342bce7fed0b9f8b4207ed3de6255debbd0fdcd37
- MD5 64d0e098c6559e0fb82dfde5ba152142
- SHA1 3dbd4264536120ca404e11867aea9b9948aa7247
- SHA512 9d754f75c6447d901215e9c021d690b96a35d928e0b4fcf821aab4d236019604d9cad682e4102d47e1b888bd6a12620f28ee98cd985c919e46f913454c956fe7
- SSDEEP 393216:bxQiT/MDb8zQAqt6Lb+vDXeGKjdzf975a9Xzvyk1aA9cBsN49P3/9:tQiT4v3wLb+r3KNf9c1vypSN4b
- TLSH T1415733915C2C2056F5459AB052FEFE9533FD98230738868D8A8526D3FF96DE10E9E3C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
NidQrForm-SETUP 3.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
NidQrForm-SETUP 3.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app-32.7z
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app-32.7z
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
LICENSE.electron.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
LICENSE.electron.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
blink_image_resources_200_percent.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
blink_image_resources_200_percent.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
content_resources_200_percent.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
content_resources_200_percent.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
icudtl.dat
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
icudtl.dat
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
locales/am.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
locales/am.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
locales/ar.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
locales/ar.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
locales/bg.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
locales/bg.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
locales/bn.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
locales/bn.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
locales/ca.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
locales/ca.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
locales/cs.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
locales/cs.pak
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
locales/da.pak
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
locales/da.pak
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target NidQrForm-SETUP 3.exe
- Size 27.6MB
- SHA256 85fd01ab2e73dd7baebcb9a342bce7fed0b9f8b4207ed3de6255debbd0fdcd37
- MD5 64d0e098c6559e0fb82dfde5ba152142
- SHA1 3dbd4264536120ca404e11867aea9b9948aa7247
- SHA512 9d754f75c6447d901215e9c021d690b96a35d928e0b4fcf821aab4d236019604d9cad682e4102d47e1b888bd6a12620f28ee98cd985c919e46f913454c956fe7
- SSDEEP 393216:bxQiT/MDb8zQAqt6Lb+vDXeGKjdzf975a9Xzvyk1aA9cBsN49P3/9:tQiT4v3wLb+r3KNf9c1vypSN4b
- TLSH T1415733915C2C2056F5459AB052FEFE9533FD98230738868D8A8526D3FF96DE10E9E3C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- TLSH T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target $PLUGINSDIR/app-32.7z
- Size 27.3MB
- SHA256 5efb7cd0293b88b45c2714873b85bd71a6b5953bdac1ebe766da3e6627acfc4e
- MD5 1a71e334a9dae28592ae75ff3ad26a92
- SHA1 6070d0e5a9e86460cebe84ffa684b07987dc9b23
- SHA512 c8664b95e4238091c6ab7474b70003e23b10cd1386cea04cb2efa699e4939267bc3f5f618a1f83709832a2f44c994d3bd51fbade0995cbd77abb1e1056968417
- SSDEEP 393216:gxQiT/MDb8zQAqt6Lb+vDXeGKjdzf975a9Xzvyk1aA9cBsN49P3/U:yQiT4v3wLb+r3KNf9c1vypSN4a
- TLSH T1885733925C2D2096F544997052EEFE8533ED9C37063886CD898621D3EF9ADE10F9E3D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 7bb06e74cf96489449a46938a8fddabf76c4adf181d8de697cfb1db5236eef9d
- MD5 22feab8f9d493bb225dff1f8b7882c18
- SHA1 8e28009105e238a91bd725e054b92d106d9ddc38
- SHA512 46c6e31183538c6b5e281cb70b5a1050ce771354214d86d7c8d17f35b8431a6c17d1e4dcd8df6d4e403abd762f0431db5bc647885e61deca920e41afdf37752c
- TLSH T19211895E726113731C56139059659C85B26B725B7DEF3384346DF288231E468E9F7804
- MD5 SHA1 SHA512 TLSH
Score1/10 -
- Target blink_image_resources_200_percent.pak
- Size 24KB
- SHA256 1c4f11111f9c40f0a85a4854fa3fa7e112deb27b6aaad1388eb9e1427d550692
- MD5 61cebc61b4d0f7e29564b340311e5478
- SHA1 c374d753d938281ab2f3d9f7fd454d8542832dc4
- SHA512 0dd56cde910ee3ad1a3833ed82e753b67df638bdcd9da3135bc97a9bb8d170bc19fd772d07588883a2f881203bb3e752660edaed00f5df433376a8be28b3cb85
- SSDEEP 384:Q144+Sm92lT2PJXPrJXPneEUO8Xs1IgHemMC+rNOuukqR2XVcjucbvTBcZQIHmmp:+W2lTp7tsiOT8lcKchcZQO8YT
- TLSH T1F5B27CF65B789DB5CEA61B31120731F4F833266411E2609947BED83CADBA6C864B1783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target content_resources_200_percent.pak
- Size 15B
- SHA256 261e6aad3ad0a5f608b5694919ee39026c4c3eb4256540068f7c1aa46be9315a
- MD5 7c321056f805aabd5a503821fa1994cd
- SHA1 9c690875c9189c66c93ebd4c0971739653bccd19
- SHA512 8a5f4b3726e4513251475ac470f86f0daa0d5ae42bb750019ce96ed871cb04a7391cea2cef79e67c585e3a982041575e60d0f79b3a5bb9ad09be53362787f090
- MD5 SHA1 SHA512
Score3/10 -
- Target icudtl.dat
- Size 9.7MB
- SHA256 6747c6682cb478bb187c6ef856e0e79bcdc746c9c3d865aafd6182e62ca3f2ce
- MD5 1b0ec60f1caf5ecc5e2a16c83ba0fcb8
- SHA1 1b8b6c882ce33a1911581ef2108e42b66abb57b1
- SHA512 9319782859c5edb791b86d6b3447650564ce9295f69a41dd87c4f327f2c9fb0e06af6e10d31168078093a9f9f264d9bd15e67427be3257fd4ddb61594018f772
- SSDEEP 98304:0CUHvt1DcdUFAhPo4PgIdmQCJliXUxjdSeWhlnbkLWY50e8O:0CUPty2AZHoICliXUxjdSeWhlnbkv0Q
- TLSH T10DA65A02B6EB4DC0F9F79F74DAF0626B6427BD41AE31815952052F3B5D732A0A760B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/am.pak
- Size 6KB
- SHA256 1779259a7ef3f010644340d852c1ed874be669f93dfea0a47150a48daca04db4
- MD5 aa7b74314c934f8a366201608f37635a
- SHA1 d0c54832f5306adb5f1ff3a5e467f4d6027f5151
- SHA512 3de080697229cb96f4d9025328913acd86a592f493c698d2cf709bdb8e520e59abdc9f1f3ba37f477c610b18fe671adbdfe1e2c150a384b94c061d57d92a99f3
- SSDEEP 192:QPBR03O84gHSdKfDWJngOvFfkxFfdpj8IY8YS3dRp79SNP:QLE8/hTvWx11Y8YShhSNP
- TLSH T125D1A954EEFCF7271F8DCA1EA412298E55A59D05A180287CD30BA7EC2F3DB6B0C99025
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/ar.pak
- Size 6KB
- SHA256 42ae1635846f4af8dbf0e00f31a6d6f388c4ee945c18a4a08d0ea6c18d33b277
- MD5 fd05f733707576524cf05aefdd6ed1ed
- SHA1 a13d6540484d85f9d890a03da9ea0f107899744d
- SHA512 cacf3f23ec6687461af0c06fcd99865aef845e2701ce0488aa0b302606392825f4b446e5ed100fa0948aa1835e64b4a353acd83902025a67b3d945321896b74d
- SSDEEP 192:IF1pxnQpslHZo/zjH26bojOpGDuT/j8I8hi8v8hqCPC5/s5k:bO5oLjH26EjOpBC
- TLSH T1EDD1EFF29A2188761B51DE0FC1D3346CE9736D239B5BFC3124934B3191DB816E68E239
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/bg.pak
- Size 7KB
- SHA256 03317347b6c26587798ae1a03708f9ee09813e9b18781529bac1b79b756197a6
- MD5 dadb1351df68c58f4e1f887fe66039c3
- SHA1 182bb203834a5bb98abadcd5569baff1178c8939
- SHA512 07da4e8462e53f55de5eeb1703c4a38c0ce86051031ad1a77ac9c316ad243c375218bef8803e1a350008b238a05db26ca856206318efeed4a17489be3a2187ae
- SSDEEP 96:js9ggCtRlmX4DRkRRUzvjjDAHSZwIQshZNlLBXWeOwg0sRC:gGgCtJ4WPcSZRhZIe9s0
- TLSH T155E19761969B249F1106F56F88047E083CEB81FF7FBA839201657DBD38E207486BE94C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/bn.pak
- Size 9KB
- SHA256 167cabe1289dc869cca51bffee17b73b22e35be83eb50f3eb83d58c2c096603f
- MD5 7b798a4603e07feca7be4a5159780a1e
- SHA1 4ad791001f76ab508f85f6267a4a0d59d9a5ab1a
- SHA512 2b3703dc2bc1966296e4f3ae188ea44adc7c43a52f85416cd6225a1610fbfdfc2b7bc847aee6f7f6d1d8c7be955cc1405d37b39e99ab70d9d60800b3331112c3
- SSDEEP 192:eGDC6XaYQON69AiA+X9ITRAnALA/AQAY//4y9Vec1Jg:ep6X4ON69AiA+X9OAnALA/AQAYH4y9V0
- TLSH T1531299209CAE90F2B8E2CDCA434CA3748157AE57936AF75CCC176248786EC3C899DD75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/ca.pak
- Size 4KB
- SHA256 3f9948a806480e3123c76a9ea436ed03fdfd88cb016162a0684f4264e7326338
- MD5 b4b113ac99d0741b34da0006c0b25763
- SHA1 454a45addd54e438b5c07fb2ae87bd2e40cc53bb
- SHA512 fe90f9d8a9992a32cfeaa2b7beda175cc592f37e83833b202329ab648d3a2293ce54b0944f189740bf54ce8703582a9e2559a0fa89c0bad0bd509814cb43538e
- SSDEEP 96:bbK9vEHfKA/nFGBlJ5tyIYfBcZbISSZSnJz94IvXqUQEQ6TH3HzniX7:bbK6rnwPTjYfCZ8BZeJz94IvXqUQEQ4S
- TLSH T156918772D7BD6F2DADE3D26F76C778474CB8DC04AE04C86BE25B030A228D9AC611A511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/cs.pak
- Size 4KB
- SHA256 09b47c990e2a8e6d32130cecd2502b590fa1861f50db55c9e2b03c0c46ad2da2
- MD5 b9430d01baed2e6680300dd7802d6733
- SHA1 d79af82f1b0b72394c4666b15d9b858d04e67c5e
- SHA512 7577c3243b06c9967138adf0c9239f4e247fb8d6a1f73cb72056256d854f7f6448a423e9a47adb89784823ce4970cd11232ebad325d6576d4bc7cfcf130afa2c
- SSDEEP 96:4URj9prAjTLKGgACuoiU+lJe7oS8QQgWu6/K3eVeRl2cLqI:TrAjPK2oitnWoS8Qcu6y3WYP
- TLSH T15D91F8ECFAB4F52495D4CA2FB1CB3E06591F17342FA95620058B798A2130F9D3C97518
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target locales/da.pak
- Size 3KB
- SHA256 1ded32e89f4d685e9d4d5dc957be7d5210206416cd698b8efe42833c40c37e9d
- MD5 8a22547166694fb489c48c1856503829
- SHA1 32c0a28ee9ff94722c0fbe35e38a7d0cdc401aa6
- SHA512 1cec84d83e57af3b537194ad1d9ec4bb5b259bfd82e7311d4cc719cfa67e08ceb420305114ed961053f32654ecdbc721a68dbe430780280762c84583f0dc140a
- TLSH T1BD81D986F457FF2C6BD4C4BF79933C678D0E89318951280F6803579B6ABB064917F260
- MD5 SHA1 SHA512 TLSH
Score3/10