NoCapture_latest_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NoCapture_latest_x64-setup.exe
Size 4.4MB
Sample260930-nwyfwsvcpf
SHA256 411fa9f769e714d96462cfd6e6daf5d37350a579d495e08e66be3c9f50d67e7b
MD5 e6ad677f1b6b031c24010812a51de539
SHA1 62cc33dc086fdc2cc33694ecd4c085cbdc2312e4
SHA512 7ee5846d5297af14b21a6bd375011c1a331bebb0fce1ab699c2ded8d929b3cf9d246d146d6befb2c9f4b472af857e05d0a0b0dbecd3e735a0e322a7827a29a45
SSDEEP 98304:CB3VTxL+Hp2RT7pK1X2ovkYNV41PE5XlJzLyJv8kUlCbxy+:Cz90sT7A1X2ovkdNEFPyJv8dcJ
TLSH
T15E2633722AB7A6E2FF1DC8F256A99073E362D3EE0859C13216346F71747E2C0794C295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
NoCapture_latest_x64-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/NoCapture.exe
unpack001/kloak_agent.exe
unpack001/kloak_bridge.dll
unpack001/kloak_engine.dll

File Explorer

NoCapture_latest_x64-setup.exe

.exe 4.4MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
NoCapture.exe

.exe 15.5MB
kloak_agent.exe

.exe 207KB
kloak_bridge.dll

.dll 207KB
kloak_engine.dll

.dll 247KB

NoCapture_latest_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 411fa9f769e714d96462cfd6e6daf5d37350a579d495e08e66be3c9f50d67e7b
MD5 e6ad677f1b6b031c24010812a51de539
SHA1 62cc33dc086fdc2cc33694ecd4c085cbdc2312e4
SHA512 7ee5846d5297af14b21a6bd375011c1a331bebb0fce1ab699c2ded8d929b3cf9d246d146d6befb2c9f4b472af857e05d0a0b0dbecd3e735a0e322a7827a29a45
SSDEEP 98304:CB3VTxL+Hp2RT7pK1X2ovkYNV41PE5XlJzLyJv8kUlCbxy+:Cz90sT7A1X2ovkdNEFPyJv8dcJ
TLSH
T15E2633722AB7A6E2FF1DC8F256A99073E362D3EE0859C13216346F71747E2C0794C295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

NoCapture.exe

IMPHASH 60487b281ab258e02852d537ecc2e99c
SHA256 38b701158eeb532758324ea4f988e82354ba85108200d6bfcf4fbda4d8cf60bd
MD5 be1c3197472238cc7122ac88e17d622b
SHA1 ccc43644b05585777fb24494e67d43b22526fe45
SHA512 09200b80df9eced13b64a55ab97c626282b2a44ec16f9626e6df6383e198648d63471b579e26fbf4be2db7ea13930315923800637cde265bd079d12cb6c63ed2
SSDEEP 98304:sb/VAwm+zl8f6aOeaThpcdT0kB14txJQESXxiaRW8x+TvKFskpFSNzVMyoSn9:aM+58f2lpGcDuXz4I4KFZK9
TLSH
T140F607217B5A996CD09BC474834B8A724A7170CB0B35B9FF448492382F6EBF56F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11273224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AppHost.pdb

bcryptprimitives

ProcessPrng

kernel32

FindNextFileW RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetFullPathNameW GetExitCodeProcess GetSystemTimePreciseAsFileTime WriteFileEx FlushFileBuffers GetTickCount MapViewOfFile FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary GetProcessHeap GetFileSize LocalFree UnlockFile HeapDestroy ReleaseSRWLockExclusive HeapAlloc GetSystemInfo GetNativeSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree HeapCreate AreFileApisANSI RaiseException CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW SleepEx ReadFileEx WaitForMultipleObjects CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW CancelIo QueryPerformanceFrequency IsProcessorFeaturePresent SetEnvironmentVariableW FindClose FindFirstFileExW SwitchToThread GetFileInformationByHandleEx LoadLibraryExA DeviceIoControl CreateSymbolicLinkW GetFinalPathNameByHandleW CreateDirectoryW IsWow64Process GetCommandLineW lstrlenW GetCurrentProcessId GetEnvironmentStringsW GetCurrentDirectoryW K32GetModuleFileNameExW K32EnumProcessModulesEx SetLastError GetCurrentThread SetThreadStackGuarantee K32EnumProcessModules AddVectoredExceptionHandler K32GetModuleBaseNameW DuplicateHandle SetFileTime SetFileInformationByHandle SetFilePointerEx CreateMutexA GetCurrentProcess GetEnvironmentVariableW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileMappingW QueryPerformanceCounter RtlVirtualUnwind OpenProcess AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent RtlPcToFileHeader LoadLibraryW VirtualFreeEx GetExitCodeThread EncodePointer TlsAlloc TlsGetValue TlsSetValue ReleaseMutex WaitForSingleObject SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx InitializeCriticalSectionAndSpinCount PostQueuedCompletionStatus GetOverlappedResult SetHandleInformation GetConsoleMode ReadFile WriteFile UnlockFileEx CreateFileA LockFileEx TlsFree VirtualAllocEx WriteProcessMemory UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW LoadLibraryExW GetFileInformationByHandle GetModuleHandleW InitializeSListHead GetModuleHandleA GetCurrentThreadId Sleep GetProcAddress GetUserDefaultUILanguage GetLastError ExitProcess CloseHandle RtlUnwindEx GetTimeZoneInformationForYear LCIDToLocaleName CreateEventW SystemTimeToFileTime CreateRemoteThread CreateMutexW SetNamedPipeHandleState HeapCompact CreateFileW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW EventUnregister EventSetInformation EventWriteTransfer SystemFunction036 EventRegister

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtReadFile RtlGetVersion NtWriteFile NtCreateNamedPipeFile NtOpenFile NtDeviceIoControlFile

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ole32

CoUninitialize CoInitialize CoTaskMemAlloc CoInitializeEx RevokeDragDrop RegisterDragDrop OleInitialize CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree CoIncrementMTAUsage PropVariantClear

user32

SystemParametersInfoA SetPropW GetDC SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor DestroyIcon RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendInput RegisterWindowMessageA SetParent MapWindowPoints CreatePopupMenu GetWindow SetFocus IsProcessDPIAware GetParent FindWindowExW SetWindowRgn EnableWindow SetMenu SetWindowTextW IsWindowVisible GetWindowDisplayAffinity GetWindowThreadProcessId GetWindowRect DrawMenuBar RegisterClassExW GetKeyboardState CreateIcon VkKeyScanW GetMenuItemInfoW CheckMenuItem DestroyMenu GetRawInputData CreateAcceleratorTableW InsertMenuW AppendMenuW RegisterClassW LoadCursorW SendMessageW SetWindowDisplayAffinity EnumWindows TrackPopupMenu FillRect GetClassLongPtrW DrawIconEx GetWindowTextW GetWindowTextLengthW GetClassNameW SetForegroundWindow ShowWindow IsIconic SetMenuItemInfoW GetForegroundWindow GetWindowLongPtrW IsWindow GetMenuBarInfo DestroyWindow GetAsyncKeyState RegisterHotKey UnregisterHotKey OffsetRect GetWindowDC GetKeyState ToUnicodeEx GetKeyboardLayout DrawTextW ReleaseDC MapVirtualKeyExW SetWindowPos DefWindowProcW GetUpdateRect ValidateRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient GetMenu DestroyAcceleratorTable CreateMenu RemoveMenu RegisterTouchWindow GetSystemMetrics AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos CreateWindowExW SetCursor InvalidateRgn GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW ClientToScreen PostThreadMessageW PostMessageW DispatchMessageW GetMessageW MapVirtualKeyW EnumChildWindows DispatchMessageA TranslateMessage GetMessageA IsWindowEnabled RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint FindWindowW PostQuitMessage TranslateAcceleratorW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes GetMonitorInfoW EnumDisplaySettingsW SetWindowLongPtrW

gdi32

SetTextColor CreateCompatibleDC GetDeviceCaps BitBlt CombineRgn SetBkMode CreateRectRgn DeleteObject SelectObject DeleteDC CreateDIBSection CreateSolidBrush

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

d3d11

D3D11CreateDevice CreateDirect3D11DeviceFromDXGIDevice

coremessaging

CreateDispatcherQueueController

shell32

SHCreateItemFromParsingName ILFree ILCreateFromPathW SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW SHAppBarMessage DragFinish SHGetKnownFolderPath DragQueryFileW SHGetPropertyStoreForWindow

propsys

PSGetPropertyKeyFromName

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

ws2_32

WSAStartup freeaddrinfo getaddrinfo WSACleanup WSAGetLastError shutdown bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv getsockname getpeername getsockopt closesocket

crypt32

CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertCloseStore CertFreeCertificateContext CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertOpenStore CertCreateCertificateChainEngine

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s wcscmp wcsncmp _wcsicmp strspn strlen wcslen strcmp strcspn

api-ms-win-crt-math-l1-1-0

floor round pow trunc __setusermatherr log roundf

api-ms-win-crt-heap-l1-1-0

calloc _msize _set_new_mode realloc malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initialize_onexit_table _c_exit _cexit __p___argv __p___argc exit _register_onexit_function abort _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _beginthreadex _endthreadex _exit terminate _crt_atexit

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kloak_agent.exe

IMPHASH 1837f376b829b6ff67bf8a65a36e6da4
SHA256 e68e5ad88c0d668066ee7d6c523e5e293ad0167a24de959dc6e62438a720df55
MD5 4c83a42486b67d9e12caff7527b7797a
SHA1 aa6cabc45743e37f892508254df3f67bdf710d36
SHA512 4eb0886bdc15f13550df5a26cf840013127c1d01dcfdcf3ef915d8f9e9778d5c3bd2ed68cd84c486bad4a3c173a798c1fd7d3432232d10390f19811065c9194f
SSDEEP 3072:mJ4nMOfk6FKloAnxXspcbrtR8Tkgg0ZogOxJoZIthw2VDZq:yy7fkBxX1/b8Qg/ZxOHzDZq
TLSH
T1CD248E1332C194F6CC6B117558FCD7788E3EA5210B11CDE747E81EB88F61BE15A35A2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kloak_agent.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

VirtualAllocEx WriteProcessMemory GetModuleHandleW GetProcAddress CreateRemoteThread OpenProcess GetLastError VirtualFreeEx WaitForSingleObject K32EnumProcessModules K32GetModuleBaseNameW HeapSize CloseHandle LCMapStringW CompareStringW LoadLibraryExA FormatMessageW GetProcessHeap HeapFree HeapReAlloc lstrlenW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex WideCharToMultiByte SetFilePointerEx FlushFileBuffers AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary GetCurrentProcessId TlsFree CreateFileW TlsSetValue FindFirstFileExW FindClose GetConsoleMode GetFileType SetEnvironmentVariableW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DecodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer GetModuleHandleA GetModuleFileNameW ExitProcess RaiseException RtlUnwind HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP FreeEnvironmentStringsW QueryPerformanceCounter GetCurrentThreadId TerminateProcess RtlCaptureContext FindNextFileW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime

oleaut32

SysFreeString SysStringLen

ntdll

NtWriteFile RtlNtStatusToDosError

kloak_bridge.dll

IMPHASH f9527e2b9dcef138f49a96d46d5ca819
SHA256 9b72d9d0c858443b076bc43847b44590a9f1dbcf9ee37b1e8c071879e9d5e399
MD5 e904f7a48355c8f8d58630c22fe2b5ff
SHA1 538269dc85415380c14a06163e7c8e90e1d176ea
SHA512 99b10b3afa28083b6fb04cf78eec7d3da38fe141058a838c25670e48b2ce496824fe4206cb5cdcefa05d462aad1cb470e6d0fe7be5a575c545059c53eb44f3f1
SSDEEP 3072:hj4U2YeRznQZqdOOeRaM9PLIjRTz9nG2RXJFKctfrRd/GFjXIWbi:OU2YeRcZJRaCMFTz5JJnIW
TLSH
T1FF248D033284C4FEC86E0171687ED7284E79E5150B11CDEB87E49CB88FAA7D19E35A6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kloak_hook.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

WriteFile GetCurrentProcess K32GetModuleBaseNameW SetStdHandle K32GetModuleFileNameExW CloseHandle HeapSize GetStringTypeW LCMapStringW GetCommandLineA GetLastError GetCPInfo GetOEMCP FormatMessageW GetProcessHeap HeapFree HeapReAlloc lstrlenW WaitForSingleObjectEx LoadLibraryA GetProcAddress CreateMutexA ReleaseMutex WideCharToMultiByte SetFilePointerEx FlushFileBuffers GetACP WaitForSingleObject IsValidCodePage GetModuleHandleExW LoadLibraryExW FreeLibrary GetCurrentProcessId TlsFree SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList RaiseException RtlUnwind IsProcessorFeaturePresent CreateFileW GetStartupInfoW FindFirstFileExW FindClose GetConsoleMode GetFileType GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime FindNextFileW RtlCaptureContext GetModuleHandleA GetModuleFileNameW ExitProcess TerminateProcess HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW QueryPerformanceCounter GetCurrentThreadId DecodePointer

user32

GetWindowThreadProcessId GetClassNameW GetWindowRect SetWindowTextW EnumWindows SetWindowDisplayAffinity IsWindow CallNextHookEx InvalidateRect IsWindowVisible SetWindowsHookExW UpdateWindow UnhookWindowsHookEx

ntdll

NtWriteFile RtlNtStatusToDosError

kloak_engine.dll

IMPHASH 9125bf444de564c84dc2aa456c754c7f
SHA256 4ef5a79978c1790a59e8340307430343f615045fa13174de3e4a3dcc9cac583c
MD5 21b43fc882ce0ac1c88bff12190bf2ba
SHA1 0e4a18eb2275c1b74906c9d4a4285a0dc974881a
SHA512 e51f6d5f815948bd85121197d5ae47f1025810d4ea17cb6b5866e01d33cd7794ffce6f8c4f674b1d781fa26867d48642508a2da0c9d727992c79fc8f874372bb
SSDEEP 3072:9+WHFl0pb4i+YGM65VHjVx2kdS/z9LcO988w3h8rnxHWvd5IE97AuGFAF8AA1:9+W4b3+LDnS/pB889u/RbA1
TLSH
T1BF446D1576915CB8D85BC03C86478A65A773B8890B31DAEF036403396F6BBF39E38764
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kloak_hook.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

WriteFile GetCurrentProcess K32GetModuleBaseNameW SetStdHandle CloseHandle K32GetModuleFileNameExW HeapSize GetStringTypeW LCMapStringW GetLastError FlsFree FlsSetValue FlsGetValue FormatMessageW GetProcessHeap HeapFree HeapReAlloc lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetFilePointerEx FlushFileBuffers FlsAlloc WaitForSingleObject GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage SetThreadStackGuarantee GetCurrentProcessId SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList CreateFileW FindFirstFileExW FindClose GetConsoleMode GetFileType GetModuleHandleW RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA GetModuleFileNameW ExitProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentThread HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW QueryPerformanceCounter GetCurrentThreadId TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW

user32

UpdateWindow GetWindowRect SetWindowTextW EnumWindows IsWindow GetWindowThreadProcessId CallNextHookEx InvalidateRect IsWindowVisible SetWindowDisplayAffinity SetWindowsHookExW GetClassNameW UnhookWindowsHookEx

ntdll

RtlNtStatusToDosError NtWriteFile

Sharing

General

Malware Config

Signatures

File Explorer

NoCapture_latest_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

NoCapture.exe

bcryptprimitives

kernel32

advapi32

ntdll

api-ms-win-core-winrt-l1-1-0

ole32

user32

gdi32

api-ms-win-core-synch-l1-2-0

comctl32

dwmapi

shlwapi

d3d11

coremessaging

shell32

propsys

oleaut32

ws2_32

crypt32

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

kloak_agent.exe

api-ms-win-core-synch-l1-2-0