removeallexec[.]exe

General

Target
removeallexec.exe
Size 32KB
Sample260919-n2yzlsfa45
SHA256 feb3524cb1767e2b6314ea956e33f7fb7e0aec23ef54274014e8d74782472c99
MD5 3f6a4b012e9da92a5785b48f13853cf6
SHA1 79c0ae7136bc1cfbf350402b7d48db930e315f89
SHA512 f2d26cdb1f1d1326eb8880d72d6441751cc746c526ee6ad0b15f4c9c918270b30676be8deb63fed68f933fabfa54b8103609cfdea6896579fee1073119830d10
SSDEEP 768:fNZaOeT/r9AujlKBI1Cr5FYzgCX5pHMXMbDD3hslbK:YTl0sCrnYzggBMXMbDD32lbK
TLSH
T18BE2BF1053DA1625DF796F356DBB96100F39FB538E21C7AC15A8124E8D337A88632BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
removeallexec.exe
unpack001/costura.dll

File Explorer

removeallexec.exe

.exe 32KB
costura.dll

.dll 5KB
costura.pdb

7KB
microsoft.win32.registry.dll

.dll 25KB

removeallexec.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 feb3524cb1767e2b6314ea956e33f7fb7e0aec23ef54274014e8d74782472c99
MD5 3f6a4b012e9da92a5785b48f13853cf6
SHA1 79c0ae7136bc1cfbf350402b7d48db930e315f89
SHA512 f2d26cdb1f1d1326eb8880d72d6441751cc746c526ee6ad0b15f4c9c918270b30676be8deb63fed68f933fabfa54b8103609cfdea6896579fee1073119830d10
SSDEEP 768:fNZaOeT/r9AujlKBI1Cr5FYzgCX5pHMXMbDD3hslbK:YTl0sCrnYzggBMXMbDD32lbK
TLSH
T18BE2BF1053DA1625DF796F356DBB96100F39FB538E21C7AC15A8124E8D337A88632BF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\rudik\source\repos\WindowsFormsApp14\WindowsFormsApp14\obj\Debug\WindowsFormsApp14.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

microsoft.win32.registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9a9d281c1a708aaae366f82fd6a1742f65da2918cc4fa5eaaaada0be24277d9
MD5 59c48aacb1c413c108161afe13fdbed9
SHA1 31ace4b26d8a069c84aad6001e06c2a5483806f3
SHA512 8252abe64c67863d9e4c70e820f0c69c517b8678a4b4c13a436118bc276e5f21e84522b93566c0bc009effcb251ed67bdbc60e4907abea2f33b6be3764e28d1d
SSDEEP 384:j4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWfdHRN76+fVlGsa9h:j4QVrxViR9mlxd96lv
TLSH
T140C22912AFE8023FFFFB0E316975D5120EB6FAC52912961E1548D28A1DB2BC8D531738
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f7:b6:99:b4:22:72:5d:60:72:4d:cd:e6:ad:87:41:f4:90:42:b8:ac:9a:00:ba:37:a8:a2:d1:9d:fe:22:40:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb

removeallexec.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

microsoft.win32.registry.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

removeallexec.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

microsoft.win32.registry.dll

mscoree

dotnet