winstall-Alex313031_Thorium_AVX2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
winstall-Alex313031_Thorium_AVX2.exe
Size 893KB
Sample261022-ythyjatxd1
SHA256 962fab77a44b6af845dad1a13f349d9c8b37248add87b2663268e1edd092834d
MD5 32b748d44c78b13010f9df73d493098e
SHA1 0729d3f01c7a50450096898386b0cde563159f12
SHA512 8c1710224948f9cd664c5a481f4845a88c3f7ecdf62e13e43b5cfab210474a716e5a5a7182e10f55f50d6bd4d394acc08bc86e7d51959116a2dcc0faa60a6bdf
SSDEEP 6144:38J2qDRESypESYQBxGXjzHpNwEK6AZPPrOsETw9ja2bTkeYe5sRegrOGVjDRSmn7:i24REnUbxK6AtrWePEebgrO8jFVPtP
TLSH
T132158C17F2A415F9E4A7C178CA524912FB327C5A0771DBDF139086692F236D09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

winstall-Alex313031_Thorium_AVX2.exe

.exe 893KB

winstall-Alex313031_Thorium_AVX2.exe

IMPHASH bcd1e89ba743b2c1a50d175672379729
SHA256 962fab77a44b6af845dad1a13f349d9c8b37248add87b2663268e1edd092834d
MD5 32b748d44c78b13010f9df73d493098e
SHA1 0729d3f01c7a50450096898386b0cde563159f12
SHA512 8c1710224948f9cd664c5a481f4845a88c3f7ecdf62e13e43b5cfab210474a716e5a5a7182e10f55f50d6bd4d394acc08bc86e7d51959116a2dcc0faa60a6bdf
SSDEEP 6144:38J2qDRESypESYQBxGXjzHpNwEK6AZPPrOsETw9ja2bTkeYe5sRegrOGVjDRSmn7:i24REnUbxK6AtrWePEebgrO8jFVPtP
TLSH
T132158C17F2A415F9E4A7C178CA524912FB327C5A0771DBDF139086692F236D09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

78:2b:e7:77:e3:1d:59:6c:12:b1:18:01:29:8c:d3:46:d2:e0:19:48:94:1f:d2:97:84:12:3e:71:ab:ed:12:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4169881,CN=Splashtop Inc.,O=Splashtop Inc.,L=Cupertino,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:d2:3a:70:6a:b8:5c:32:49:08:37:95:4b:9e:41:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 20, 2025 - May 19, 2028

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

119404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW Sleep LockResource CreateThread LoadResource FindResourceW GetCommandLineW RemoveDirectoryW GetTempPathW WaitForSingleObject GetFileAttributesW GetTickCount64 DeleteFileW GetCurrentProcessId CreateProcessW CopyFileW GetExitCodeProcess ReadFile ProcessIdToSessionId GetLastError SizeofResource FlushFileBuffers CreateEventW SetEvent FormatMessageW WriteConsoleW HeapReAlloc HeapSize CreateFileW GetConsoleOutputCP GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx CreateDirectoryW WideCharToMultiByte GetLocalTime CloseHandle OutputDebugStringW MultiByteToWideChar LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetConsoleMode WriteFile ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle

user32

SetWindowLongW PostQuitMessage SystemParametersInfoW UpdateWindow InvalidateRect GetClientRect SetCursor GetWindowLongW GetMessageW DefWindowProcW PostMessageW GetWindowRect SetWindowPos FillRect CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW ShowWindow DispatchMessageW TranslateMessage LoadIconW LoadCursorW

gdi32

GetStockObject SetTextColor SetBkMode DeleteObject CreateSolidBrush CreateFontW

shell32

ShellExecuteW SHGetFolderPathW

ole32

StringFromGUID2 CoCreateInstance CreateStreamOnHGlobal CoUnmarshalInterface CoCreateGuid CoUninitialize CoCreateFreeThreadedMarshaler CoInitializeEx

oleaut32

GetErrorInfo SetErrorInfo VariantInit SysFreeString SysAllocString SysStringLen

sspicli

GetUserNameExW

comctl32

ord345 InitCommonControlsEx

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

271KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winstall-Alex313031_Thorium_AVX2.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

sspicli

comctl32

api-ms-win-core-winrt-error-l1-1-1

generic