stremio-shell-ng[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
stremio-shell-ng.exe
Size 4.2MB
Sample260913-ashpdacf85
SHA256 3bdc15f2d386cce4f11224e0fc5797cfbbd37246285d8c81b2a4499d25d1b51f
MD5 47386bb4c85dad6a4b6aa63a03b9a265
SHA1 0c65d0a9a4cecc8f8cfa6c113ae40c169e811c45
SHA512 6983ef05920c99e6ef08cd8d6c03676f5a51d8a2df5d2a83afb4257dfc2bf6c9484fbfd5aa9af6563a61368409aa93cb585964a3def929443ad93de77dd20f6a
SSDEEP 49152:pCrpHof7N8h5onjPm5u+EEWEHAqndoO96BnHPzutEKPtf41oXh0Tqsb8YF4OnqJM:Es25QzN4XAaam+AgAaqdauaa5ip
TLSH
T1032619217A9A99ADC05AC07483478A736A7130DB0B39BAFF448456783F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

stremio-shell-ng.exe

.exe 4.2MB

stremio-shell-ng.exe

IMPHASH a6c4d4373d7ba79ac0050e4e4ad87cc7
SHA256 3bdc15f2d386cce4f11224e0fc5797cfbbd37246285d8c81b2a4499d25d1b51f
MD5 47386bb4c85dad6a4b6aa63a03b9a265
SHA1 0c65d0a9a4cecc8f8cfa6c113ae40c169e811c45
SHA512 6983ef05920c99e6ef08cd8d6c03676f5a51d8a2df5d2a83afb4257dfc2bf6c9484fbfd5aa9af6563a61368409aa93cb585964a3def929443ad93de77dd20f6a
SSDEEP 49152:pCrpHof7N8h5onjPm5u+EEWEHAqndoO96BnHPzutEKPtf41oXh0Tqsb8YF4OnqJM:Es25QzN4XAaam+AgAaqdauaa5ip
TLSH
T1032619217A9A99ADC05AC07483478A736A7130DB0B39BAFF448456783F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

fb:3b:6b:5c:d6:a7:b2:7a:6d:71:ed:87:0c:50:09:4d:4d:40:56:65:0e:0e:fb:99:82:e3:6e:d5:39:b3:84:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Smart Code OOD,O=Smart Code OOD,ST=Sofia (stolitsa),C=BG

Chains

Aug 25, 2026

CN=Smart Code OOD,O=Smart Code OOD,ST=Sofia (stolitsa),C=BG

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Smart Code OOD,O=Smart Code OOD,ST=Sofia (stolitsa),C=BG

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Smart Code OOD,O=Smart Code OOD,ST=Sofia (stolitsa),C=BG

Serial Number

4c:b2:b6:bd:9c:78:63:fd:80:77:01:4c:c6:a9:3c:b8

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 24, 2024 - Oct 24, 2027

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2868204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stremio_shell_ng.pdb

user32

GetForegroundWindow GetSystemMetrics SetWindowPlacement GetClientRect MonitorFromWindow GetMonitorInfoW GetDisplayConfigBufferSizes IsZoomed DisplayConfigGetDeviceInfo GetKeyState GetWindowRect GetMonitorInfoA SetWindowLongA EnumChildWindows GetWindowPlacement IsIconic SetWindowPos GetWindowLongA SetForegroundWindow QueryDisplayConfig AdjustWindowRectEx SendNotifyMessageW SetProcessDPIAware MessageBoxW GetParent CreateIconIndirect GetCursorPos CreateWindowExW DefWindowProcW SetParent AppendMenuW CreatePopupMenu SetMenuInfo GetMenu DrawMenuBar CheckMenuItem IsWindowVisible SendMessageW ShowWindow IsWindow TrackPopupMenu SetMenuItemInfoW GetSubMenu DeleteMenu GetMenuItemID GetMenuItemCount DestroyWindow DestroyMenu DispatchMessageW TranslateMessage IsDialogMessageW GetAncestor GetMessageW PostMessageW CreateMenu LoadImageW GetDC DestroyIcon SetMenu ReleaseDC LoadCursorW RegisterClassExW GetClassNameW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile

kernel32

GetQueuedCompletionStatusEx AssignProcessToJobObject PostQueuedCompletionStatus SetFileCompletionNotificationModes GetTempPathW CreateIoCompletionPort SetHandleInformation WriteFile GetTempFileNameW CreateActCtxW WaitNamedPipeW GetSystemInfo SetUnhandledExceptionFilter UnhandledExceptionFilter ActivateActCtx InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetModuleHandleA GetFileType GetFileAttributesW Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW AcquireSRWLockExclusive LockResource SizeofResource FindResourceW LoadResource GetModuleFileNameW HeapAlloc SetEnvironmentVariableW DeleteFileW CreateFileW ReleaseSRWLockExclusive GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx LoadLibraryW WideCharToMultiByte SwitchToThread ExitProcess GetModuleHandleW CloseHandle CreateNamedPipeW ConnectNamedPipe FindClose FindFirstFileExW GetLastError ReadFile FlushFileBuffers lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW FormatMessageW GetStdHandle GetEnvironmentStringsW DisconnectNamedPipe TerminateProcess CreateJobObjectA SetInformationJobObject MultiByteToWideChar GetProcessId GetCurrentProcess GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo GetExitCodeProcess IsDebuggerPresent GetProcAddress FreeLibrary CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW CreateProcessW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetWindowsDirectoryW GetCurrentProcessId ReadFileEx DuplicateHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW IsProcessorFeaturePresent OutputDebugStringW

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDevice

ws2_32

ioctlsocket WSASend getsockname getpeername WSASocketW connect shutdown setsockopt WSAIoctl closesocket WSAGetLastError getaddrinfo getsockopt recv bind send WSAStartup freeaddrinfo WSACleanup

secur32

AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DecryptMessage AcquireCredentialsHandleA ApplyControlToken EncryptMessage QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle

crypt32

CertAddCertificateContextToStore CertDuplicateCertificateChain CertCloseStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateContext CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertOpenStore

advapi32

GetUserNameW SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

gdi32

CreateSolidBrush CreateDIBSection DeleteObject GetDeviceCaps

comctl32

InitCommonControlsEx RemoveWindowSubclass DefSubclassProc GetWindowSubclass SetWindowSubclass

shell32

Shell_NotifyIconW DragQueryFileW DragQueryPoint DragFinish GetCurrentProcessExplicitAppUserModelID

windowscodecs

WICConvertBitmapSource

libmpv-2

mpv_command mpv_create_client mpv_observe_property mpv_request_event mpv_destroy mpv_terminate_destroy mpv_initialize mpv_create mpv_client_api_version mpv_free mpv_get_property mpv_set_property mpv_wait_event

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception_context __current_exception __CxxFrameHandler3 memcpy memset memmove memcmp _CxxThrowException wcsrchr _purecall __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

exit terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _crt_atexit __p___argv _exit _register_onexit_function __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

stremio-shell-ng.exe

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

dwmapi

d3d11

ws2_32

secur32

crypt32

advapi32

ole32

shlwapi

bcrypt

gdi32

comctl32

shell32

windowscodecs

libmpv-2

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic