NESTROT-4080-V3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NESTROT-4080-V3.exe
Size 72KB
Sample260906-1gpawsdd56
SHA256 51da94c238f8e5ee9399ece87cac3decd0792a931daf9d4e02666f2ccd0113b6
MD5 3b8c47a2fc20f996aed0ac3b9d3c481f
SHA1 498264e186b91479ad3e8956710a1b6b6d84500f
SHA512 cf4d51bca1997e1157f544ad63f1dd7219ed4f8d3fbaa635e6ba42f8f8c7e483a58a617c807fbbd5c913fcd68c05df6808a95428b861ab65da02ffb5588039ce
SSDEEP 1536:rsAR7PgKK7xVONTXFyIAd8s2pn41QLAetK+rw:r2ljO5XFMapnEQbtK+r
TLSH
T13873D60ED7BB81ECC85DC07981666A62EB30FD49473277EF47A19B212D50BE15E38782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NESTROT-4080-V3.exe

File Explorer

NESTROT-4080-V3.exe

.exe .ps1 72KB

NESTROT-4080-V3.exe

IMPHASH d57fd47a4afa9c8b498cedaec1d7214e
SHA256 51da94c238f8e5ee9399ece87cac3decd0792a931daf9d4e02666f2ccd0113b6
MD5 3b8c47a2fc20f996aed0ac3b9d3c481f
SHA1 498264e186b91479ad3e8956710a1b6b6d84500f
SHA512 cf4d51bca1997e1157f544ad63f1dd7219ed4f8d3fbaa635e6ba42f8f8c7e483a58a617c807fbbd5c913fcd68c05df6808a95428b861ab65da02ffb5588039ce
SSDEEP 1536:rsAR7PgKK7xVONTXFyIAd8s2pn41QLAetK+rw:r2ljO5XFMapnEQbtK+r
TLSH
T13873D60ED7BB81ECC85DC07981666A62EB30FD49473277EF47A19B212D50BE15E38782
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA

wsock32

gethostbyname gethostname inet_ntoa

winmm

waveInGetDevCapsA waveInGetNumDevs

libc++

_ZNSt11logic_errorC2EPKc _ZNSt12length_errorD1Ev _ZNSt12out_of_rangeD1Ev _ZNSt20bad_array_new_lengthC1Ev _ZNSt20bad_array_new_lengthD1Ev _ZNSt3__111this_thread9sleep_forERKNS_6chrono8durationIxNS_5ratioILx1ELx1000000000EEEEE _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcy _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEyPKc _ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc _ZNSt3__115__thread_structC1Ev _ZNSt3__115__thread_structD1Ev _ZNSt3__116__libcpp_tls_setElPv _ZNSt3__119__thread_local_dataEv _ZNSt3__120__throw_system_errorEiPKc _ZNSt3__122__libcpp_thread_createEPPvPFS0_S0_ES0_ _ZNSt3__15mutex4lockEv _ZNSt3__15mutex6unlockEv _ZNSt3__16thread6detachEv _ZNSt3__16threadD1Ev _ZNSt3__19to_stringEi _ZNSt3__19to_stringEj _ZNSt3__19to_stringEm _ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_ _ZSt9terminatev _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZTVSt12length_error _ZTVSt12out_of_range _ZdlPv _Znwy __cxa_allocate_exception __cxa_begin_catch __cxa_free_exception __cxa_throw __gxx_personality_seh0

libunwind

_Unwind_Resume

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf_s fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp tolower

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit system

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strstr

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

advapi32

CryptAcquireContextA CryptCreateHash CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptHashData CryptReleaseContext RegCloseKey RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

shell32

SHGetFolderPathA

user32

CallNextHookEx CloseClipboard DispatchMessageA GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyboardState GetLastInputInfo GetMessageA GetSystemMetrics GetWindowTextA IsClipboardFormatAvailable OpenClipboard ReleaseDC SetWindowsHookExA ShowWindow ToAscii TranslateMessage

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateProcessA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlushFileBuffers FreeConsole GetConsoleWindow GetFileAttributesA GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemInfo GetTempPathA GetTickCount GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency ReadFile SetFileAttributesA SetFilePointer SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WinExec WriteFile

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NESTROT-4080-V3.exe

wininet

wsock32

winmm

libc++

libunwind

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

gdi32

advapi32

shell32

user32

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic