0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf

Sharing

Copy URL Twitter E-mail

General

Target
0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf
Size 86KB
Sample260903-p6mykshk2t
SHA256 0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf
MD5 ec8b5874952208cf8d8a0928d10b823e
SHA1 a1f0340b0f92525b506cb8f76f56a875bd101edb
SHA512 2b6606737c9f412715e3931a9c679ce5078853f3074dde15f635ba5e7abc12e92fb8ef0b704e8808017733a11baa5f6cbf0f60bc312275d536da8a25f741f424
SSDEEP 1536:I4lVqauhF/NXcLUv8OFal8JBXJeUazHTkDl9VGAyAzt8ZqFgv+erKB8TuEHmu89J:I4lVWhF/NXkUuOJBXJJazHqnVG1o8Qhz
TLSH
T1A193F1E1B6C054F7CA538A3207B7B77BE67BD6102125164B17105F7A3A32683EF1A352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/supersonics.dll
unpack001/Uninstall Lamje.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall Lamje.exe	nsis_installer_1
static1/unpack001/Uninstall Lamje.exe	nsis_installer_2

File Explorer

0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf

.exe 86KB
$PLUGINSDIR/System.dll

.dll 11KB
$TEMP/Blindworm.cab

33KB
$TEMP/supersonics.dll

.dll 22KB
Uninstall Lamje.exe

.exe 33KB

0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf
MD5 ec8b5874952208cf8d8a0928d10b823e
SHA1 a1f0340b0f92525b506cb8f76f56a875bd101edb
SHA512 2b6606737c9f412715e3931a9c679ce5078853f3074dde15f635ba5e7abc12e92fb8ef0b704e8808017733a11baa5f6cbf0f60bc312275d536da8a25f741f424
SSDEEP 1536:I4lVqauhF/NXcLUv8OFal8JBXJeUazHTkDl9VGAyAzt8ZqFgv+erKB8TuEHmu89J:I4lVWhF/NXkUuOJBXJJazHqnVG1o8Qhz
TLSH
T1A193F1E1B6C054F7CA538A3207B7B77BE67BD6102125164B17105F7A3A32683EF1A352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/supersonics.dll

IMPHASH e07e00e45407ff0dd6abc9eaa981fa7b
SHA256 f861f64e2d1fab3825ea0ff29ae5ccb067bc9dc6c8ee48e886b4f4b8aaf1d976
MD5 85d7439ea9de45c9d3988048b4992080
SHA1 386ba295d816412330d8720a4a71bd2dc3c7fa6e
SHA512 08e120cc6e9e6fd29430553aea8e7a922cf9c6d56382adb67b1883199964d174dee44c0b47cd9b62062f43e3d3b75a2765a3bce183d8343fc4cd9b7ae58be2d5
SSDEEP 384:TVSJ7YV9VZ1MCG2mjDQTPl9KJ44od+L0uK9ZYNcy7A3QWF1/0YiJIwy:TIJ8TSGmjYPXU44od+L0D9ZYNR7OQWFi
TLSH
T116A2C565F74AD045E48941B5300BD7B225127D30728554ABB7838F242537BFFAAEAF0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

20587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Uninstall Lamje.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 ef6716634f67f1fc444dce6f3e3b840a94920231d02a95ddd37e5ef28d29242e
MD5 d45eb9d3f43c2294a2c0efd896bb0ee1
SHA1 3b603792109b74bba6e92099d02bf984b39b81c2
SHA512 adfb1965de3872f15e881a037b1811b469383f6cafc18ab09f02d6028a0d0515912e3f40942c35e31d6daefc7e71dd999f42ccde848c5b6d41c4adbe0e011c5b
SSDEEP 768:CP4lVqdYQDAqFHfNXcLKIo5Bt9a0983eF5Al8JH1fT3XJedizJRn3EX:I4lVqauhF/NXcLUv8OFal8JBXJeUDEX
TLSH
T10DF28ED277D0907BD5D306720BB7E7B7D67792201125A6876F10AFBA3D21683DA0B382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

0441f0d5923c29446f47317a5713c8869a8610edbaeb4b4dbbe9a09cb12da7cf

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/Blindworm.cab

$TEMP/supersonics.dll

msvcrt

generic

Uninstall Lamje.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic