FleetInstaller (11)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FleetInstaller (11).exe
Size 39.2MB
Sample260908-cbrl3ace69
SHA256 b88e0c358e24aad02fe95842f0a7bac30c2f01995679832083133f4aaf1f45dd
MD5 8b7e66097ece045a8d97694619879100
SHA1 3c741ccb5e7d2d7a64612e2b0449275c78448dab
SHA512 e83261c15b80c8fc6ec2b79af33eebf2452ea14173d8e289fcd73ab06ced92c27479750e1e559ac7e4ec5b614957d08a66d223cb90fc7ecf535088551f85fa8c
SSDEEP 786432:0qaSC0JNQ6G7SFjtq5BuZwczOWpJg+mhzmxyw7E8sOzDMElm/GF8en094VLaE58N:Lal0W+kIwaJgBh6xyw7EIDYuFvn0mVOH
TLSH
T11397336A647B654BC50E67F6128DCE61DD7BF813C34209FB0884C3A19FE59C92F2CA61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FleetInstaller (11).exe

File Explorer

FleetInstaller (11).exe

.exe 39.2MB

FleetInstaller (11).exe

IMPHASH 754fcaa16a4fdf51beb2a5c2a05bc078
SHA256 b88e0c358e24aad02fe95842f0a7bac30c2f01995679832083133f4aaf1f45dd
MD5 8b7e66097ece045a8d97694619879100
SHA1 3c741ccb5e7d2d7a64612e2b0449275c78448dab
SHA512 e83261c15b80c8fc6ec2b79af33eebf2452ea14173d8e289fcd73ab06ced92c27479750e1e559ac7e4ec5b614957d08a66d223cb90fc7ecf535088551f85fa8c
SSDEEP 786432:0qaSC0JNQ6G7SFjtq5BuZwczOWpJg+mhzmxyw7E8sOzDMElm/GF8en094VLaE58N:Lal0W+kIwaJgBh6xyw7EIDYuFvn0mVOH
TLSH
T11397336A647B654BC50E67F6128DCE61DD7BF813C34209FB0884C3A19FE59C92F2CA61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

246352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fleet_setup.pdb

kernel32

FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber GetProcAddress SleepEx CreateThread LoadLibraryA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW MoveFileExW CreateWaitableTimerExW SetWaitableTimer Sleep SetFilePointerEx LoadLibraryExA WaitForSingleObjectEx GetCurrentProcess SetLastError QueryFullProcessImageNameW GetCurrentThreadId GetCurrentThread OpenProcess Process32FirstW SetThreadStackGuarantee ReleaseMutex CreateToolhelp32Snapshot GetCurrentProcessId FindNextFileW Process32NextW GetProcessHeap HeapFree HeapAlloc FormatMessageW SwitchToThread GetTickCount64 GetModuleHandleW GetModuleHandleA GetExitCodeProcess GetSystemTimeAsFileTime CopyFileExW TerminateProcess RemoveDirectoryW GetLastError FindFirstFileExW WaitForSingleObject CloseHandle CreateMutexA FindClose SetUnhandledExceptionFilter GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind InitializeSListHead WideCharToMultiByte lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW HeapReAlloc AddVectoredExceptionHandler WriteFileEx QueryPerformanceFrequency QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW ReadFileEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

advapi32

RegSetValueExW RegCloseKey RegGetValueW RegCreateKeyExW RegDeleteTreeW

user32

SetWindowPos RedrawWindow KillTimer DestroyWindow SetWindowTextW GetWindowThreadProcessId PostMessageW IsWindowVisible CreateWindowExW LoadIconW MessageBoxW GetDlgCtrlID SetFocus GetWindowTextW GetWindowTextLengthW SystemParametersInfoW AdjustWindowRect GetDpiForWindow PostQuitMessage DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW RegisterClassW LoadCursorW SetProcessDpiAwarenessContext SetLayeredWindowAttributes EnumWindows ShowWindow SendMessageW SetTimer GetClassNameW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree

comctl32

InitCommonControlsEx

gdi32

CreateSolidBrush SetTextColor SetBkColor SetBkMode CreateFontW DeleteObject

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shell32

SHCreateItemFromParsingName SHGetSpecialFolderPathW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW

ntdll

NtCreateNamedPipeFile NtWriteFile NtReadFile NtOpenFile RtlNtStatusToDosError

oleaut32

SysFreeString SysStringLen GetErrorInfo

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset memcmp __CxxFrameHandler3 memcpy memmove

api-ms-win-crt-math-l1-1-0

roundf round __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _register_onexit_function _configure_narrow_argv _set_app_type _seh_filter_exe _crt_atexit exit _exit _register_thread_local_exe_atexit_callback __p___argc _initialize_onexit_table __p___argv _cexit _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free