jaffacakes118_Trojan[.]Win32[.]Nisloder[.]ui[.]cb4367db67962f36b38ed5f2cc2c3235

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235
Size 514KB
Sample261018-spvtmsfx51
SHA256 fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd
MD5 cb4367db67962f36b38ed5f2cc2c3235
SHA1 9f5574be9cbf6983ffeb1fec2b8ad72b87967674
SHA512 80ce8b6dde4a7676b014391698c9ca8f27dda1ce1b9cab483b2f1926996836fb9b995b967ccecadc3bcbd4086d90a683868049ce60907152cf6565fac9cc08cc
SSDEEP 12288:tsp8SE5ArAhq13jWaqsB5eol5auT04wy3ePPPz+JwXwh:Oi5q1pqsauY4srWV
TLSH
T117B42340B3D120F7E9961D320DF6E297D27A17F9F729505F2B044EFB38E62A641192CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/counterpunch.dll
unpack001/WindNinja-2.0.1/Uninstall.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/WindNinja-2.0.1/Uninstall.exe	nsis_installer_1
static1/unpack001/WindNinja-2.0.1/Uninstall.exe	nsis_installer_2

File Explorer

jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235

.exe 514KB
$PLUGINSDIR/System.dll

.dll 11KB
$TEMP/StoaCognoscenti.bin

424KB
$TEMP/counterpunch.dll

.dll 68KB
WindNinja-2.0.1/Uninstall.exe

.exe 49KB

jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd
MD5 cb4367db67962f36b38ed5f2cc2c3235
SHA1 9f5574be9cbf6983ffeb1fec2b8ad72b87967674
SHA512 80ce8b6dde4a7676b014391698c9ca8f27dda1ce1b9cab483b2f1926996836fb9b995b967ccecadc3bcbd4086d90a683868049ce60907152cf6565fac9cc08cc
SSDEEP 12288:tsp8SE5ArAhq13jWaqsB5eol5auT04wy3ePPPz+JwXwh:Oi5q1pqsauY4srWV
TLSH
T117B42340B3D120F7E9961D320DF6E297D27A17F9F729505F2B044EFB38E62A641192CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/counterpunch.dll

IMPHASH 7b33c4cf4af641891ebc83ed2efc8f1e
SHA256 9fa3cfd7236097bb87445e9401916037797a84fe56768cd3fa63dfb470950cf7
MD5 945b5b91aeda04c62a3dffad18eb1dc7
SHA1 aef842a008d05332ca5f8206077204645983f1cc
SHA512 9fa1ed5f550515e737eca5943d898d814e0c180299f0b64cdec170ccab9ca9c74cfcaca65faae7dcdfbcc9d0c4c172ff0bd6c65b84a70e19823ce7ff4192cb84
SSDEEP 768:xJzu7/F7xIyMgNZpDReu51Kl7+Dql0J9Z8aY4it8oP8+lu:H3PgNrFeYqWV8awt8oPFu
TLSH
T1D9634C113A9184FBD58E413804A7CB72163ABC4256F694533FD76AEF4E326A0F53B30A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

DefDlgProcA ShowCaret SetWindowsHookA PostMessageA HideCaret EndMenu wsprintfA DrawFocusRect

ole32

CoResumeClassObjects CreateAntiMoniker

comdlg32

GetOpenFileNameW ChooseColorA

kernel32

LeaveCriticalSection LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA HeapReAlloc ExitProcess GetProcAddress WaitForSingleObject GetCurrentProcessId SetWaitableTimer GetModuleHandleA GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP HeapSize RtlUnwind MultiByteToWideChar GetLocaleInfoA VirtualAlloc

WindNinja-2.0.1/Uninstall.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 59da837155daeb16cc292f403995134103ef28109a3d76a944e8485266c599c1
MD5 5baa74e26a59fb847a09b0b6b54ddf7d
SHA1 904e0c52e472ffd98e223046eef5b378b72447fd
SHA512 ca1cbb0427299b8de745782f53c62d1bf3564b7dad03441fa450b6442b386e67fd6d179433e5f8ec5f94dc2f75135b60dc1383e1b616017adb6b97ddbf5956af
SSDEEP 1536:WwJOoN1oYaoZ5iV685XJPChgdLeAyNJzZS:WwJ52Y7ZoH5XJahceAUZS
TLSH
T13D33AF1337C584ABDBA605710EF7E7BAE7B5F7B021158A5B2B009F7F6D602838E05186
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/StoaCognoscenti.bin

$TEMP/counterpunch.dll

user32

ole32

comdlg32

kernel32

generic

WindNinja-2.0.1/Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic