Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    OInstall.exe

  • Size

    14.6MB

  • MD5

    4c746e46fb3ced72a49290baf9f115f4

  • SHA1

    3cbb5c1380496b121289ea6e14d5007d71e7e3e7

  • SHA256

    1c7d1f5635d70f870fa2686743e759c8446c5e46fa2ea1250494f505845baa1d

  • SHA512

    0482cb95c79179a9665ead17bdb1111badb02ee9d7524ebbfa810008fe7661da7cee553be97f0034b7fb4e9f66ecdd3568cbed873b67914545440635fe608080

  • SSDEEP

    393216:T4sLMkgDxJBnLZ3xJZwmxjxhC59j5/sZDPXn1Syset+uh:ks72/t3xJ5rC5ecS

  Score

  10^/10

  evasionupx

  • Blocklisted process makes network request

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1

• • Target

    out.upx

  • Size

    29.2MB

  • MD5

    fcc3a6ad8b68714f49b301a87802f19a

  • SHA1

    153a8c2ecc8e8cfd50a7308ad95a2eb6dc5ef605

  • SHA256

    f1f929f79a4394cfbe4e554d97aceeb5f5e3f4de58dd60dbff5a115ade9bde7a

  • SHA512

    d93ac16d222920f29f983e095d91b4f36be0ce57fa5d1b8c4429560919b4061f426715ab1de675a5c75b86f94406aa599fb8549070b5dccf17c0379610748375

  • SSDEEP

    786432:1o/RC88KMjqzSGFPt7lgx+Gft4k42m/bE:OJaKMjqzSGJt7lg/ft4k42mDE

  Score

  1^/10
  behavioral2