chromelevator | 2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

resource	yara_rule
sample	family_chromelevator

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

resource	yara_rule
sample	pulsarat_module
static1/unpack001/dashboardapp.common.dll	pulsarat_module

resource	yara_rule
sample	family_quasar

resource	yara_rule
sample	costura

resource
2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/costura.dll
unpack001/dashboardapp.common.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/messagepack.annotations.dll
unpack001/messagepack.dll
unpack001/naudio.core.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll
unpack001/protobuf-net.core.dll
unpack001/protobuf-net.dll
unpack001/sharpdx.d3dcompiler.dll
unpack001/sharpdx.direct2d1.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll
unpack001/sharpdx.mathematics.dll

2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5b26d8de37d9ce27798a7eff03d4da8b4437a9bc3146f3f412186990a038e505
MD5 ade0404beb7b15f2b43829c8b2d3b29e
SHA1 849d7504c5d35eac4eda16ba2fdb950160932dbf
SHA512 2dad096f96cca306290db892e1569f00147db2c6425769379f06614a775cfc00275cc2f427f3a52a02870f4b97ac121ed1ad21de6e9f77b6639afdbcc9b42161
SSDEEP 98304:dDlqaY09t9nH+drndDP5uXv0mxx1dKm77Lrwk9Wd6:fqfotteNdDxOv3xxzLsaWw
TLSH
T1ED261210F7F4426AE2FF9679A97288058B73B8435B75D7CF069854EA0E633808E35763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4673726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

dashboardapp.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f7f871b88c871eaa23077842cb6b7625c6d40adcd8d0a248a82ab9576726e0c3
MD5 24f1c0b2ac710e2ee703d2d48eb6f24b
SHA1 7178897967d912feeddf7b17a988bff34edcd0e0
SHA512 bb15681789ad0c0e14836f68dfa1610b3bd22d22fdf58c1dc036b4bccab971f4a23c78944f7146336521006d48a6797924140f8c0f19e2cdb0799f1d136d5013
SSDEEP 3072:YEoWw/RIvLaQ0ev19wYtCXICYm7RFBngL0X50Uej1UG3lZ1Ya2krf+1Sej8Y:YjWoxQpwYgI6WpjaG37heo
TLSH
T185242811DB55CFA8D69E8B78B0B9445457BEE60A3452EBFA8743E2D83C027C604943FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

222706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\H30xx\Desktop\Poopsar new\DashboardApp.Common\obj\Release\net48\DashboardApp.Common.pdb

dashboardapp.common.pdb

SHA256 9ae68b0ee65d6c198fe6887d5b4ebb94815ab8bb2d44e4d5daf137cfc5f2471b
MD5 af586cd3e556b2a57287f239435ad180
SHA1 7a3013219ab09c9965ee8247ee7c3fbe7b176e3c
SHA512 e829317d319d795766d8ee60c1116433ca188e414a1120c3acdb357472a09c5dd43d9501a22d1ddd8deb6a78218a30420b52ad2d54a9dd60720e8d5644d64fb3
SSDEEP 6144:28S6srJZ0+CT1kiDE7Ak6JX/l+bSD8CLXwKV:226Jm+Aiixks58kg6
TLSH
T152445C499EA45E0DC54B10BFF45BB326A7BD8020EB026703D76CB6F96E26F850C93B54
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 38395717f48e1e64bd29c6cb5df11349f011cae5f9fce0264b53252d60cdd191
MD5 38be3b238310387bb5fa85a999326277
SHA1 b927071b902b777cda7e52a6f79af9cba1c62fdc
SHA512 d83baa0e86b75d9720073fa88109c182bc6d10af617d559ddc16f448e5c507f702256f4715d817250cf78362388bdd3ce109c6e9d11254ec57727a58dfddc659
SSDEEP 768:o/t9KqQ6Un424sqnaxTRLTxT2Wjq7oEs+hfQ9X5xXK:olgh6a424sT7v93ji/sQY9Xi
TLSH
T11E436C24835C0337CBDD8B7FA476412A87B1D7863953EBB7AB9881F02863B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

messagepack.annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bba53a8b44184fce30178502149ada027185e17f4156baf2dc38ad6c1550cdd6
MD5 5f5ccdc8a5e5b02d5d2505be43176a4a
SHA1 9e55a5101ab8bda197d610a7d8c55ace4a79c768
SHA512 c6b565ebe09b35c17827d476fd7f3d9c7f730b5a8b34be9711eecca49966757c3d5b221e84f72214ef9d7cab85324a46ba78a589f552d3feff9f5c6047498401
SSDEEP 384:LC9rT5pVmE6yc1xEpYFC/vkfLRcwJLlj9LW:qj0E6yYxiOC/cf1cwJLljB
TLSH
T11C82D835A398A377DE3B0AF9FC2462610F3AE5483503E63B9708D4572B06BC146A0B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack.Annotations/Release/netstandard2.0/MessagePack.Annotations.pdb

messagepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a1f3dd74ad4fcc6ca1ffe2f09d3faa0191f1fa44064da1876218ad3f652111f
MD5 1f1f3f1457d2329100d84007c9462b97
SHA1 ea0d7793f5ed2b191096524080c1dacc54a213ca
SHA512 277d9fecb283cbfc1d2abf7290ea5184cbb4661e8fea2bbc26df6a68bb63a7bfdcdeb60b5bb4ef7ef75ec0fbf2e29ab33b456f9e883186f4a61a9984c0c47cfb
SSDEEP 6144:qR2B7682usChZtGHkB0MlIlQorrUteo/xsDC+zk:zB7682usChZtGHKKgtbxYC+Y
TLSH
T1AF846CA863D88F52EAEF47B4D83420088B7ADC17F493E3AF158471F61C6B7859991363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

384698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack/Release/net472/MessagePack.pdb

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
MD5 ff34978b62d5e0be84a895d9c30f99ae
SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
TLSH
T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

73:a6:36:c1:dd:b5:ab:95:84:54:f7:d7:ec:c4:a1:7e:22:c6:c0:c4:77:c8:31:52:a6:11:c8:6c:c8:6e:03:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.net.stringtools.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 81925a5e0e690da37e64929511dc007da32d59db7134f701fe6e2706f8eb3895
MD5 c9e9e9b99552931845dee6e4a17f603e
SHA1 6b7839dc2a44caa0b501333dd3c6915a0601e8c0
SHA512 b83c0930550d5abd0c47eff7c5afb77f541ba0c68851f325ebd16b0d2fd3d0a9a62b7af701e8b0014a2f3cb271854e3492970f0b243c825cd7f7dbfe4599302e
SSDEEP 768:Y3yPquIgIKBOKCttmxWk4FClgFT9zO2EK:Y3yPquTIKcKC/4WkkigTzOzK
TLSH
T174E25B50A3AC0322FEFE1970A571D5979F35AB876861EF5518ACF10D084B3D49E22B3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f8:6c:b2:1a:8a:43:63:b6:17:fc:a6:b8:f9:d5:ef:1e:88:b6:c8:b0:22:5d:cb:5a:ae:e6:d1:be:bd:23:e5:6d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 6, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

26246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/StringTools/Release/net472/Microsoft.NET.StringTools.pdb

microsoft.net.stringtools.pdb

SHA256 b77d6fb8fcabffe08940ba56dda61470cf07fb398c6939d6611f3a544145e72a
MD5 13d7a9590b03e4a421076966201b0b26
SHA1 244b8c029973b7cfe767e4aaa14f483fea54060b
SHA512 55620f12ef9938f586365be973c30ad7d6ee8ea869865836ce4dea7d2e28556211323b1db1b36cf4d760838edac5c7244ec3d2bb76235860bdf08fce97f67f48
SSDEEP 192:3dHjrSRpFqhM/vM5CSoBjOSmPsNsw+sthotlapsbVTv0MNvMR1zi1i:NypFqhaBylkNsrst6t0pMhv0MNUR1zi8
TLSH
T10D12F8A776888B56CA032D32111283D653B1E1645A787FD4E1C80DA9BCCE72F2E3D3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.win32.registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

19162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

185178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
MD5 be8205f435b2afbfd178960c46310c17
SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
TLSH
T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

63254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Nov 3, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

0

Major OS version

4

Entry point

713798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

protobuf-net.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 716e5dc398bca7c4b13b38d2ed72f04b8d76b03fb6f3293e2225b17614533517
MD5 d33aa4ddcf9d2f849249ab28b652ca02
SHA1 6c1cdaee497a0a7dd3d831e367f0f76ad02ddcb9
SHA512 7f09bf135de40e369810140f65f38bb8cd62153a6ce1cc2bc43baeb850f4a47d670ea1884a50efd0e5b5a2a8332c93c0161d79d2721d4dda005432aaf916770b
SSDEEP 6144:GE9CN+H3fk2IvNcN15gnzSz251pl5CPMxqGB+t:cYEcN12SzM2MxqG
TLSH
T164543A181FDC8E66CDFE65B4BCB08ACD0AF6F612D0A7D7C56054D2F7A8823805E146E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

292990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.Core.pdb

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ca62620b36b834c4d345831f467d40c24e5dc5606c688521e0a277470a1c24f5
MD5 f968979832738bf0922220ff8c958894
SHA1 346157a44019867fa102e06fdf63b95798c63f74
SHA512 e088f7959811e313996b93984e36481e143759dd990efd2dd5b85fcad48a3fa02a029c9ea042bab30ddab1aec67d8ba0adddfbab0badceca2c235aa53709ec05
SSDEEP 6144:6LhfaAGys6YWGJaWzbgZZllHbyo/TDdkG0:PvlnwllHbJTDdL0
TLSH
T1E8446D5D37FC0A1AE6BF6BB6ACB0144046F5FD1BA566EB8E588050FD0C23B815A107B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

282070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.pdb

sharpdx.d3dcompiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 268b44a78354f7a225e5b1567223179c7b73453c0a27eb4bf18bb57d7a8e08d9
MD5 66aeaaba0629daf8544afc8008079386
SHA1 1e09e5d24e1aa3d1700b265c6ff94b7524813f4d
SHA512 dd2cd1df484600e6cc3e686e64559c3447f255f723b5f57cd51f76a838a79416bf68b7a7b380467bce172fc3ec868eb54a0d754108926782d31bb0cbd66f5a54
SSDEEP 768:VbFZAPoGIjmU9ZMPVNOhTJCj+775suxTvJREFhtK4shNeYJub4h8ZGdwv1PmQYEQ:Vm9SXGunREFhtKhNeA+4h8Md81VYExO
TLSH
T1E4434D21E7486256F68E0BFDB0264F064331F2467417E78BB9CC98E52D97354EB1A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.D3DCompiler.pdb

sharpdx.d3dcompiler.pdb

SHA256 226f82b448c2f8700ca5c9f3658a0808a251f98d8543753e6231bc41b2a2053c
MD5 3c7ce2802daee6dba9e39970995c4069
SHA1 4fb7a312cc269cb44487b0fee6b94695024a6b0b
SHA512 203b5f374ae63ad4f9a3f926d8d0afd351f2886d6b3a1ff6d0356c080980e850b9934b875b34accab8eb0382a69b168c3497484bd2ce9f2f4b23b5230d751ac6
SSDEEP 384:OXwP73y8HB6AreJkS9RBbwX/QreSLG1UI43I6Y3Ix:OXmyiB6hkSVsoFI60Ix
TLSH
T1ABA29415E3E0AD3DDB833A3760636327837DD04886CB8F0712ECD7BABD997044666A59
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

sharpdx.direct2d1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f4b5e240cb42ce903082f81633bba0c781c1e684fd5903bc3915e3805b5e83e
MD5 b992dfabf27b4c32c57d5cc2960cd8e3
SHA1 b012190d4cefbca3c63218f8fcd6e7211de40913
SHA512 f6d86cb73cb44c2d0ced4585f628f953ff604adde07da724f64122c6d07536985c4052a4aadfabee69f16a47797ef87f48e46eb5ff9601d0d3564aa4979f9467
SSDEEP 6144:90MJT4AfGTJX022MfHZJo/AuiEqQvWW9mArUXCxfBRh2O4OFr77:l4BJECZSxBW6mvS7RhQ8r
TLSH
T1B8B44B1127D84B2BD98D5EF7D171861892F8D10BB227EB4B398691794DC33214E0EBEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

500894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct2D1.pdb

sharpdx.direct2d1.pdb

SHA256 c85d2fd579c5ddc47d6c7f9a399558931447c66cc878218fdf78708103a4c5ab
MD5 b7e9ec399d002f3c92a80d73296b8fee
SHA1 44e30b6f808b43a07716f804cf694f95ebeeaac5
SHA512 68222884e0dd0b4d9552717efa64ddbcaad8f12c83f8bf6e32f6b2d2699021ec73f005c21a981857a723f862aac58e09ba819958a3736a45c75930011158af30
SSDEEP 3072:DSaGja/imizEYq7wlvNqrrFdnW7SXuIC8MsjjHtZRRftTFZ2aOO:x6ev4EYq7SvNqVdncIC8Ms7RjTFZrL
TLSH
T1E824D70AEA58831DCB368A3515A7D2162370D288DC4FDB4FB6ECA7391C5B78A04B357D
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 07137e5cc4d5ecc95ca267c9dce042d4
SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
TLSH
T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

288270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct3D11.pdb

sharpdx.direct3d11.pdb

SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
MD5 1600d8adb3e99f85c1e9719e59828559
SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
TLSH
T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 c52a44933d17d576d4c97b4cb0545841
SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
TLSH
T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 d2edde626c241549eab636aa87fb5d38
SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
TLSH
T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.DXGI.pdb

sharpdx.dxgi.pdb

SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
MD5 44e3cf00d4eda7f4aa38044d578aa537
SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
TLSH
T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

sharpdx.mathematics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 3e296ec3bb24750833ea80515e6fb4c73874c91a
SHA512 f9d3b296e14d72f4bff727acfdcfb520ae1436ba5ded03be04a559f493d4a8f9f915c0a2f498214309d0b84d6b3ae29750186615ae3250ad218aeb09dd7175ab
SSDEEP 3072:BW+i1u3AZ2YRCPJ4e3qHKSOZ53ZSOUE5Cgil7MEcR5hpGO5wZ+iEZUn1Bt+ZknSB:BdAZDCziyEs5Pib+ZknSTpc
TLSH
T14324E75CCFEB4576CBAACAF9F01D0EDB67295158122FEF1AB19894FA0803369D1012D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

221054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Mathematics.pdb

sharpdx.mathematics.pdb

SHA256 ca3492f46e271c70182d04783b4731c6a6ead3659ffa22ec02a758b3905e8508
MD5 2056464074215066d3d06abbba1a0519
SHA1 c2d459a790cb21aa1c8fa92f55b96804aefb78aa
SHA512 eedef1f1dcead2f15928d24028c62b518f7f6b89a4e739b64c3c1fae0b1123dc9c1a6ce024187cf2656cf5620ca670858435ab6d9c34ef9a99e283b1c14bcdf9
SSDEEP 1536:1ernxRpKZkJklUHHIWNVXVxYGGGGGGGjQYXHEmM7F7MlXZE747fBL/zdx:cbKK1NVXJTXkt7F78e747fBLJx
TLSH
T179938327CA888606CD06A9778972072533B9D0A8974D9F4663DDF379FCA3B50A9D334C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

sharpdx.pdb

SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
MD5 2883c3a35927e62ebe1871c130e93f31
SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
TLSH
T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
MD5 af7880a90c02c0115cd169c7182ab378
SHA1 6e3ccf50bb1d30805dce58ab6bdd63e0196669e6
SHA512 5377f83cfb8b9892727ed22ba0b9b1a75b2d4750caa6da04f4eeb0f6f9c0f75949226b2ca00876ad1f4c9de02f8ffb1cbcdb3048fbe6d26a6119148282e818a1
SSDEEP 3072:QBn4ZzK9VbHknD118xm7DnNeHr6n4xJ2WGK8xSSpz5TXui5cb7rq2cAVaSX7hyVY:Qn8CVbHknvteO4xMlpQbHcSzkVaND
TLSH
T15C344A04B78C9B76DA6F89F3B9A0D46A0E72C51360DB739A60DEF7E42CC37949C58094
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

48:5c:ff:60:3a:fb:bd:3e:3d:27:c2:f1:6a:e0:d4:da:f8:bd:6e:ae:ca:08:33:3b:e1:a4:90:5f:9d:70:d7:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

246334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.security.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

26694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb

system.security.principal.windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

66:14:6a:1c:ea:9c:3d:ac:d8:5a:fb:65:4e:52:79:df:9d:05:29:ea:6b:fd:f3:7b:a3:29:c0:13:11:0a:76:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

11394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects ChromElevator
Detects Windows executables referencing non-Windows User-Agents
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing virtualization MAC addresses
PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

dashboardapp.common.dll

mscoree

dotnet

dashboardapp.common.pdb

gma.system.mousekeyhook.dll

mscoree

dotnet

messagepack.annotations.dll

mscoree

dotnet

messagepack.dll

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

microsoft.net.stringtools.dll

mscoree

dotnet

microsoft.net.stringtools.pdb

microsoft.win32.registry.dll

mscoree

dotnet

naudio.core.dll

mscoree

dotnet

naudio.wasapi.dll

mscoree

dotnet

naudio.winforms.dll

mscoree

dotnet

naudio.winmm.dll

mscoree

dotnet

newtonsoft.json.dll

mscoree

dotnet

protobuf-net.core.dll

mscoree

dotnet

protobuf-net.dll

mscoree

dotnet

sharpdx.d3dcompiler.dll

mscoree

dotnet

sharpdx.d3dcompiler.pdb

sharpdx.direct2d1.dll

mscoree

dotnet

sharpdx.direct2d1.pdb

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet