Extracted

• • Target

    ExpressVPN_setup.exe

  • Size

    2.3MB

  • MD5

    b8a48ef181d65145334e2ff0e0d3fbf6

  • SHA1

    53263570e35e8d528c4f56073dc2ba6e9a97819c

  • SHA256

    9cb9bb13a44968f6b919829342f692d27d45b66cc1e0108a072d7ba3d940fe1a

  • SHA512

    fc5a22ba1cc008132ef3ecd16119896477057a174b002da01fa28b246396fb2b372d1cf768fee6a8c799413762d476d01139f340a2b3e8336364d758cf482b19

  • SSDEEP

    49152:SkkzqgxeGbknWS8+VIBixnz2fZUH+sfFxbQ9oOnfzerEm4WM/o:SkklMWS8+VWIzQZ8+sfDYtfzeT4WMA

  Score

  10^/10

  upxcolibribuild1loader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2