fakeclient_a2200e1c[.]bin[.]exe

resource	yara_rule
sample	costura

resource
fakeclient_a2200e1c.bin.exe
unpack001/costura.dll

fakeclient_a2200e1c.bin.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a2200e1c82de90bfc23cf8a4ae183b0fb7514b745734aba467ee154e6bc306c1
MD5 251da7dda7423ce9059615bd5cac6fce
SHA1 43d06a1ab4a9c5468c58228c9447005390dbb9da
SHA512 9f423e80608041bad01a74676c947db9ad92a4e0e8a942a2dd70dc4f6b8a3e365af7fb6dc6862bdafd9041b5ed0545f5b1d308d2700a63bf23b69da894b648e7
SSDEEP 12288:BCP49xsCP49xV0B3MOiP9/JvpOjxU6vQMSJDWpXNmnHrrpKXIhLO14sqRPw9x:x969PW3MbPzvpOjxV8WfmHrAXIQ9
TLSH
T149C412943BC403AEF9F18FB299F75313273A6F89C4B99B5F45A03B082579B51C2D2A41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

542638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\google\Desktop\Random file\Проекты\Сурсы\SteamSetup\Steams\obj\Release\Steam.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.web.webview2.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6c517412c245c0f0d65fc494d4f7bf883eba3cfd7023c3f66cc1fe774ec0a22
MD5 d11bf35a62c936818a1aec6adf97c580
SHA1 c41e19c622114c68a2376cfe024c8df12129dbfc
SHA512 fc3197d8188f13572b3120d69e476f06fc28493b0ae02f6c00d2815b8520d3b5258d5356636529908b773b1f07204fb7a3aea94af6826b3c3161b68b5c2ab2bd
SSDEEP 12288:MBfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsR+rP322y:EQcl41Or
TLSH
T1B9D4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

08:38:ad:d1:0c:0e:12:3a:23:9a:e0:16:dd:a7:48:c4:25:d0:91:c7:51:2e:62:a8:93:8f:97:0f:18:df:4c:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 28, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

645526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb

microsoft.web.webview2.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 362ede7adc427ff631cd313418d6d331c01eb1f7874a5ca54911130739792145
MD5 7da84c369b60a0e6c481f94adf718511
SHA1 baed762bbff901d5dfdc4653b0de5cc50fc66a32
SHA512 9f40d616d5a7cbeb504e59e32e68f262a5d7d3f865af5f06e02c18cc000c233acf9a912e5e722f3a63e695e7795ce436daa8c1df68b46e2060fafb47165617d7
SSDEEP 768:DvQNb2vIYymJ22Mss+5lQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSx8:Dcb2vLblQ+ZDgcEST3p4JjrjaeFSUyaA
TLSH
T15B033B4087ECC517E6EB1F78A9B491610BBA7EC37D61D7A90C84B1EA0C73BD055143AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

cf:f7:f9:6c:2a:93:f1:95:46:07:9a:8e:c1:d7:11:64:9c:44:2d:86:ce:81:ec:a9:e5:b5:af:7e:f1:86:fd:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 28, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

34142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net462\Microsoft.Web.WebView2.WinForms.pdb

microsoft.web.webview2.wpf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 832a517556d57d6106b6752b7568088ff2b6df434365d74a923af24d9e69cb1e
MD5 e947ba70d1f1ca000019f7a91187ac8c
SHA1 943838da675bad2a47f36e016fc38d23cf97838c
SHA512 9388edc2950df5fca80523e127cc82dea74e7bc175424366a64c6d4f8f9e1fb61356237d5ab0baea3e8781806498532ea6af68a54be2a3b0b28bbeb325673372
SSDEEP 1536:1U8jJ30lsivLfCoiWqhxaRkPqszha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0ud1:es+vLqrThx6s1a8+DHfFy30bpc4Jjr4P
TLSH
T12B836C4193BC8923CAEF1FFD7C6090140FB8FA83B652C7992985B5EC1DA379119257A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

43:3a:94:cc:ea:c9:20:f1:9e:72:84:b3:fd:c8:87:b6:3f:9a:f8:76:ce:f0:8f:c2:f0:0a:2f:42:0d:23:dc:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 28, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

78150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net462\Microsoft.Web.WebView2.Wpf.pdb

fakeclient_a2200e1c.bin.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

microsoft.web.webview2.core.dll

mscoree

dotnet

microsoft.web.webview2.winforms.dll

mscoree

dotnet

microsoft.web.webview2.wpf.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

fakeclient_a2200e1c.bin.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

microsoft.web.webview2.core.dll

mscoree

dotnet

microsoft.web.webview2.winforms.dll

mscoree

dotnet

microsoft.web.webview2.wpf.dll

mscoree

dotnet