NostalgiaAndLust_v1[.]18_windows[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
NostalgiaAndLust_v1.18_windows.7z
Size 400.6MB
Sample261107-sp43bacy5s
SHA256 8be8875e55b1a72aeb70508d214c8639c700416cee3c0c071f4c96fbba6892a2
MD5 62e19a2aea17b87c85ae2653ad782dce
SHA1 67c2ac7dd58950bc84030c293def77f59d4502d5
SHA512 11cbd5d4b6b18134cf1045f573573d9a42fbc080ac8622fa4adaac732f13f0ff636621a7755ce38bb36d03c3d3f5dabab7ea2056f833b9221ae2f068fe8fd140
SSDEEP 12582912:McNHmP7W2j43FxCoMY3XwOUk7voSU6+bhgOdQb:MiypExCoM+UmgjFgf
TLSH
T19619338FCD024DA7859FA5B31EA862DE55D10E486420D174D5CBBB2AB6F43BED043B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/windows/NostalgiaAndLust_windows.exe
unpack001/windows/Personality.exe

File Explorer

NostalgiaAndLust_v1.18_windows.7z

.7z 400.6MB
windows/NostalgiaAndLust_windows.exe

.exe 983.0MB
windows/Personality.exe

.exe 83.1MB
windows/license.txt

223B

NostalgiaAndLust_v1.18_windows.7z

SHA256 8be8875e55b1a72aeb70508d214c8639c700416cee3c0c071f4c96fbba6892a2
MD5 62e19a2aea17b87c85ae2653ad782dce
SHA1 67c2ac7dd58950bc84030c293def77f59d4502d5
SHA512 11cbd5d4b6b18134cf1045f573573d9a42fbc080ac8622fa4adaac732f13f0ff636621a7755ce38bb36d03c3d3f5dabab7ea2056f833b9221ae2f068fe8fd140
SSDEEP 12582912:McNHmP7W2j43FxCoMY3XwOUk7voSU6+bhgOdQb:MiypExCoM+UmgjFgf
TLSH
T19619338FCD024DA7859FA5B31EA862DE55D10E486420D174D5CBBB2AB6F43BED043B0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows/NostalgiaAndLust_windows.exe

SHA256 e458c3dd86807bf06b1d5965e50df5a60658ad741d08984eb6aa23cf07216bfd
MD5 5fa5aa201fc161f9583654a63bc67c8a
SHA1 635a062e373f12714854dff5ee7092b43fea6311
SHA512 634846eea0587fe6687598d4e8c4a2ff9857f79a942645ce93413dd31f43fb84850e4989cf104c2970f5b29e3d31ab2b468b388406059694b2f5ec1566317c41
SSDEEP 12582912:eI0EGXLVtDKFHf4Rp04exuPgF5CFuwWF5pe/eC0:bhGxAh2i4epF5zF5pe/eC0
TLSH
T140B97C13EBA1E4DFD18921FC853E79E1D09F2AF9D3605FD25633222086AB5726301ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

72.4MB

Virtual Size

72.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

907KB

Virtual Size

906KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14.6MB

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pck

Size

890.9MB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

windows/Personality.exe

IMPHASH 13f8e64bb57254e5370d781a91c8c79a
SHA256 5e5a3e113a2bbe7bb3782cee155411064854f3dc0effeea87a5e4ba4544656a0
MD5 5fa3a48abb86db7a80d2c5dadc8c7134
SHA1 9beacd6f3115d88f50bd0eafd7091145de21d267
SHA512 0cba6e4303732d96e5c6114592216e5b76911143f835faf1f1e530229f0db1f9150a6a9a52b50f3dc5a6a14340bb13b231fbcd0dcaa75ad54afbdba082bc9ecc
SSDEEP 786432:lAL599ZtEzkXJK53WbZ90OPfCinCmRaNP9slgPf:lAL5997pXy+Z90OPfCinCbNlsGPf
TLSH
T1A2183A03F2A370DCC56BF1709F7BA677B631B84911382D6B56938B302F61E505B69E28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges GetCurrentHwProfileA GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegEnumValueW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

avrt

AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenSystemStoreA CryptBinaryToStringA

dinput8

DirectInput8Create

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory1

gdi32

BitBlt ChoosePixelFormat CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreatePen CreatePolygonRgn CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetPixel GetStockObject GetTextExtentPoint32W Rectangle SelectObject SetDIBitsToDevice SetPixelFormat SwapBuffers

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses GetBestInterfaceEx

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CloseHandle CompareFileTime CompareStringOrdinal ConnectNamedPipe CreateDirectoryW CreateEventA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateSymbolicLinkW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetConsoleMode GetConsoleProcessList GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileSize GetFileTime GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetGeoInfoW GetHandleInformation GetLargePageMinimum GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetShortPathNameW GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultUILanguage GetUserGeoID GetVolumeInformationW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeProcThreadAttributeList InitializeSRWLock IsDBCSLeadByteEx IsDebuggerPresent K32GetPerformanceInfo K32GetProcessMemoryInfo LCIDToLocaleName LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile MoveFileExA MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA PowerClearRequest PowerCreateRequest PowerSetRequest QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadIdealProcessor SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler lstrlenW

msvcrt

fwprintf ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _cexit _chsize _commode _endthreadex _errno _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _getmaxstdio _getpid _gmtime64 _hypot _initterm _itoa_s _lock _lseeki64 _onexit _set_error_mode _setjmp _setmaxstdio _strdup _stricmp _vsnprintf_s _wfopen_s freopen_s strcat_s strcpy_s _time64 _timezone _tzname _tzset _unlock _vscprintf _vsnprintf _wchdir _wfopen _wfsopen _wgetcwd abort acos asin atan atof atoi bsearch calloc cosh exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fputwc fread free fseek fsetpos ftell fwrite getc getenv getwc isalnum isalpha isspace iswctype isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror printf putc putwc qsort rand realloc remove rewind setbuf setlocale setvbuf signal sinh srand strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strstr strtol strtoul strxfrm tan tanh tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcstol wcstombs wcsxfrm _vsnprintf_s _strtoui64 _strtoi64 _nextafter _write _stricmp _strdup _read _memicmp _fileno _fdopen

ntdll

NtQueryInformationFile

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop

oleaut32

SysAllocString SysFreeString VariantInit

shell32

CommandLineToArgvW DragAcceptFiles DragQueryFileW SHCreateItemFromParsingName SHFileOperationW SHGetKnownFolderPath SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

shlwapi

QISearch SHStrDupW

user32

ActivateKeyboardLayout AdjustWindowRectEx AllowSetForegroundWindow CallNextHookEx CallWindowProcW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateCaret CreateIconFromResource CreateIconIndirect CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCaret DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DispatchMessageW DisplayConfigGetDeviceInfo DrawTextW EmptyClipboard EndDialog EnumChildWindows EnumDisplayMonitors EnumDisplaySettingsW EnumWindows FillRect FlashWindowEx GetAsyncKeyState GetClientRect GetClipboardData GetCursorPos GetDC GetDCEx GetDisplayConfigBufferSizes GetDlgItem GetDoubleClickTime GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenuItemCount GetMenuItemInfoW GetMenuItemRect GetMessageExtraInfo GetMessageTime GetMonitorInfoA GetMonitorInfoW GetParent GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindowDC GetWindowLongPtrA GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InsertMenuItemW IsClipboardFormatAvailable IsIconic IsProcessDPIAware IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorA LoadIconA MapVirtualKeyA MapVirtualKeyExA MessageBeep MessageBoxW MonitorFromWindow MoveWindow OffsetRect OpenClipboard PeekMessageW PostMessageA QueryDisplayConfig RegisterClassExW RegisterClassW RegisterClipboardFormatA RegisterRawInputDevices RegisterTouchWindow ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageA SendMessageW SetCapture SetCaretPos SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetTimer SetWindowDisplayAffinity SetWindowLongPtrA SetWindowLongPtrW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExA ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW WindowFromDC WindowFromPoint

winmm

midiInClose midiInGetDevCapsA midiInGetErrorTextA midiInGetNumDevs midiInOpen midiInStart midiInStop timeBeginPeriod timeEndPeriod timeGetDevCaps

ws2_32

WSAConnect freeaddrinfo getaddrinfo getnameinfo inet_pton

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getsockname htonl htons inet_addr ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt socket

Name

.text

Size

65.5MB

Virtual Size

65.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pck

Size

57KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

372KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

NostalgiaAndLust_v1.18_windows.7z

windows/NostalgiaAndLust_windows.exe

generic

windows/Personality.exe

advapi32

avrt

bcrypt

crypt32

dinput8

dwmapi

dwrite

dxgi

gdi32

imm32

iphlpapi

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

wsock32

generic

windows/license.txt