> Family · 54e64e_

~/packetpursuit $ cat /intel/families/54e64e.md

typeentityconfidencemediumcreated2026-06-01updated2026-06-13malware-familyloaderdefense-evasionc2evasion

54e64e

OpenCTI opaque family label. Currently a single-sample family: a MSVC C++ x64 dropper masquerading as a system-analyzer tool.

Overview

The 54e64e label is assigned by OpenCTI/MalwareBazaar as a family identifier for a Windows loader/dropper cluster. As of 2026-06-01 only one sample has been analysed: a 5.2 MB MSVC C++ PE that behaves as a masqueraded "System Analyzer Tool" which downloads a second-stage payload, disables Windows Defender, and executes the payload. OpenCTI also co-labels this sample dropped-by-amadey, suggesting it is part of the Amadey downloader delivery chain, though this relationship is not independently confirmed.

Build Stack

Four distinct build morphs observed within the same OpenCTI umbrella label:

Morph 1 — Null-padded MSVC C++ (3b13b28c)

  • Compiler: MSVC 19.43 (Visual Studio 2022 17.3+) ^[/intel/analyses/3b13b28ca3a6d3c82228f5cc6a6e0bef583e9c3b3092da4c20fe72c75f3dd386.html]
  • Language: C++ with full MSVC standard library (STL strings, streams, exception support)
  • Packing/Obfuscation: None. No packer, no strip, no encryption. Binary is padded to ~5 MB with null bytes after a small overlay UAC manifest.
  • Signing: Unsigned

Morph 2 — UPX-packed x64 (c8db13c1)

  • Packer: UPX (3 sections: UPX0, UPX1, UPX2) with modified/hacked header that defeats standard UPX decompression. ^[/intel/analyses/c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f.html]
  • Compiler: Unknown — timestamp zeroed by UPX
  • Import table: Stripped to four KERNEL32 functions (LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess) rebuilt at runtime
  • Signing: Unsigned
  • Payload indicators: AES S-Box tables found inside compressed UPX1 section, suggesting encrypted second-stage content

Morph 3 — Go 1.25.4 signed PE64+ infostealer cluster (cc4aa789, 8017acd5)

  • Compiler: Go 1.25.4, CGO_ENABLED=0, -trimpath=true ^[/intel/analyses/8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b.html]
  • Architecture: AMD64, GUI subsystem
  • Signing: Fabricated Authenticode with subject CN=WE1, issuer CN=godaddy.com (self-signed template, 3-month validity)
  • Obfuscation: ~32 randomized main.* function names (10–20 chars each) to fragment control flow
  • Resources: No .rsrc section, no embedded icons
  • C2: No hardcoded strings; runtime-decoded or DGA resolution inferred from cluster siblings

Morph 5 — Signed IExpress SFX with AutoIt3 payload (7aed04ab)

  • Toolchain: MSVC 14.20 (Visual Studio 2019+) for base wextract.exe ^[sample 7aed04ab/exiftool.json]
  • Packing/Obfuscation: Microsoft Cabinet (CAB) LZX:21 in .rsrc; 22 meaningless-named fragments. No custom packer.
  • Signing: Valid Authenticode — CN=Tim Kosse, C=DE, issued by Sectigo Public Code Signing CA R36, with Microsoft timestamp countersignature. Signature remains valid after CAB resource replacement because Authenticode does not hash .rsrc. ^[raw/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e/signature.der]
  • Payload delivery: Obfuscated batch script (Debut) uses 383 SET variable definitions to hide copy /b /y commands that reconstruct AutoIt3.exe and a compiled .a3x script from 19 CAB fragments. ^[/intel/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e.html]
  • Execution chain: wextract.exe → cmd.exe (batch reconstruction) → AutoIt3.exe <script.a3x>
  • Timestamp: PE header claims 2062-07-25 (fabricated); CAB files show 2026-05-22.

Morph 4 — MSVC 14.0 XMM-loader with encrypted .data (6e0ef3af)

  • Compiler: MSVC 14.0 (Visual Studio 2015+) ^[/intel/analyses/6e0ef3af90cd3e4a8d48b6e5fee62e5d88f69d007135314f9014e63cfb179e93.html]
  • Architecture: AMD64, GUI subsystem
  • Packing/Obfuscation: None — outer PE is not packed, but the 2.8 MB .data section is encrypted in-place via SSE2 paddw/pand loops.
  • Signing: Unsigned
  • Resources: No .rsrc section, no version info, no icons
  • C2: No hardcoded strings; decrypted payload may contain C2 configuration
  • Notable: Mixed CRT — MSVC PE structure with MinGW-w64 pseudo-relocation handler and error strings. Decryption is gated by boolean flags in .bss.

Deploy / TTPs

Technique ATT&CK ID Evidence
Ingress Tool Transfer T1105 URLDownloadToFileW to fetch http://80.253.249.169:5000/upfevb.exe (Morph 1 only)
Impair Defenses T1562.001 Spawns hidden powershell Add-MpPreference -ExclusionPath (Morph 1 only)
Virtualization/Sandbox Evasion T1497.001 PRNG-based delay loop and verbose fake diagnostic output (Morph 1)
Signed Binary Proxy Execution T1218.011 ShellExecuteA to launch downloaded payload (Morph 1)
User Execution T1204.002 PE GUI executable, user-launched
Bypass UAC T1548.002 Admin gate via AllocateAndInitializeSid + CheckTokenMembership (Morph 1)
Match Legitimate Name or Location T1036.005 Masquerades as "System Analyzer Tool v4.2.1" (Morph 1)
Masquerading T1036 Go morph presents fabricated godaddy.com code-signing cert ^[/intel/analyses/8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b.html]

Variants / Aliases

  • Amadey dropper (unconfirmed upstream relationship; OpenCTI co-label: dropped-by-amadey)
  • Build artifact name: certpert (from PDB path, Morph 1)

Notable Analyses

  • raw/analyses/3b13b28ca3a6d3c82228f5cc6a6e0bef583e9c3b3092da4c20fe72c75f3dd386 — Deep static analysis; static-only (CAPE skipped). Null-padded MSVC C++ "certpert" dropper with fake diagnostic masquerade, Defender exclusion via PowerShell, HTTP payload fetch.
  • raw/analyses/c8db13c15ad99cc002dda644384e730497972a9995510918f5fc7e2c071b9a0f — UPX-packed x64 sibling with modified/hacked packer. Three sections, four KERNEL32 imports, compressed payload with AES S-Box indicators. Standard UPX decompression fails. Static-only (CAPE skipped).
  • raw/analyses/cc4aa789cf0c80b32004b90be6be0ad80944ad85730c6095cc3ca29469059503 — Go 1.25.4 PE64 infostealer. Signed DV cert CN=askart.com, 24 randomized main.* functions, GUI subsystem, no .rsrc, no hardcoded C2. Matches golang-stealer-build-pattern cluster; not build-related to prior MSVC siblings. Static-only (CAPE skipped).
  • raw/analyses/8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b — Go 1.25.4 PE64+ infostealer sibling. Fabricated Authenticode CN=WE1 / issuer=godaddy.com, 32 randomized main.* functions, build ID M5d1UAj2sgoz.... Static-only (CAPE skipped).
  • raw/analyses/6e0ef3af90cd3e4a8d48b6e5fee62e5d88f69d007135314f9014e63cfb179e93 — MSVC 14.0 XMM-loader with 2.8 MB encrypted .data. SSE2 paddw/pand in-place decryption, MinGW-w64 pseudo-relocation handler, indirect thunk dispatch. No hardcoded C2. Static-only (CAPE skipped).
  • raw/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e — Signed IExpress SFX with AutoIt3 payload. Valid Sectigo Authenticode on wextract.exe; 22 CAB fragments reassembled by obfuscated batch script into AutoIt3.exe + .a3x script. No C2 strings in outer stages. Static-only (CAPE skipped).

Capabilities

  • admin-rights-gate-sid-check
  • prng-delay-loop-evasion
  • fake-diagnostic-output-masquerade
  • http-payload-download
  • defender-exclusion-powershell
  • shell-execute-dropped-payload
  • upx-compression-with-modified-header
  • runtime-import-table-rebuild
  • go-infostealer-randomized-function-names
  • authenticode-signing-throwaway-dv-cert
  • gui-subsystem-no-window-code
  • runtime-c2-resolution-no-hardcoded-ioc
  • xmm-sse2-wordwise-payload-decryption
  • mingw-pseudo-relocation-handler
  • indirect-thunk-api-resolution
  • large-encrypted-data-section