62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1

Sharing

Copy URL Twitter E-mail

General

Target
62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1
Size 2.5MB
Sample260831-ffmepaveke
SHA256 62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1
MD5 2e43c0143c50acde423b0d51fc96c690
SHA1 714751125db5306bd46884ace1d47cfa755c50bc
SHA512 b6c32d80500f4aa02632d1b30534c8b63fbf8cfe01a9768369c5778304c0149079c87c05a2e70d6253527ab23020dd9beb70b5b63391acea5a42a430d551acd2
SSDEEP 49152:tKoL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:TL+2upjBVGVl/lQrCSZ4183Dm
TLSH
T166C523853BFC4948F6BFAF702DB626648579B8A25D21EB5E05C5309C1930FD5ACA0F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1
unpack001/costura.dll

File Explorer

62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1

.exe 2.5MB
bouncycastle.cryptography.dll

.dll 4.5MB
costura.dll

.dll 5KB
costura.pdb

7KB

62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1
MD5 2e43c0143c50acde423b0d51fc96c690
SHA1 714751125db5306bd46884ace1d47cfa755c50bc
SHA512 b6c32d80500f4aa02632d1b30534c8b63fbf8cfe01a9768369c5778304c0149079c87c05a2e70d6253527ab23020dd9beb70b5b63391acea5a42a430d551acd2
SSDEEP 49152:tKoL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:TL+2upjBVGVl/lQrCSZ4183Dm
TLSH
T166C523853BFC4948F6BFAF702DB626648579B8A25D21EB5E05C5309C1930FD5ACA0F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2617918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\AppData\Local\Temp\StealerBuild_colfgjax\obj\Release\WindowsService.pdb

bouncycastle.cryptography.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d9a58c84baa55a12684cd2381bca03c8f2a9cbae21a6bf1e9ebd65f495629721
MD5 b4787503d223596799f75b5a70e089de
SHA1 753612f4cccba05994e5c3eee576179b2cc68e81
SHA512 6bb819a88f3ff5f26c7c28ba672f27640f4ac96077ebcd92418dbafd9e20f7940ff7787567d3a5bb73b4455f5237f0d06f827538d72d416905d54dfd69410f0f
SSDEEP 49152:FlSk7M+wQ6G5c1EZAb8Shn9xiKa9K7nfSyUrASuCrpmDSqVCb4qcABDWIt:TSUM+eGiEZA4NfBuEoSqVCb4rABpt
TLSH
T169269E1677F81E23E15F83B696F04011A7F5F86AB393EB0B6181A37A0D63B505D422B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

0f:91:60:b8:2d:35:9c:20:33:a8:1a:68:24:9d:20:c0:28:e1:f4:c3:0e:dd:66:49:7f:8d:cb:87:85:f0:33:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU

Chains

Jul 31, 2025

CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU

Serial Number

26:bf:b3:8b:b9:c8:9b:6c:b9:2e:af:50:64:9e:e2:68

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2022 - Nov 13, 2025

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

3349454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/crypto/src/obj/Publish/net461/BouncyCastle.Cryptography.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

62272eeada9d00d377ad9ed60823f1bfa0ccbbb905d11ebf1c2b0187ae38dbb1

mscoree

dotnet

bouncycastle.cryptography.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb