Extracted

• • Target

    Setup.exe

  • Size

    99.7MB

  • MD5

    3d54a88bea517fb58ecb46f3d7f94777

  • SHA1

    b51360050b9785d01484d3d7b5c9796f98a8a0d1

  • SHA256

    13dcfc1aa528addb278f703cd8fc7b0aaf8cbeb8242bdd0a070401099de854f2

  • SHA512

    92c68b0b329b80ef892ffa838dd94e6c9d10e48e0e6f8840b9933b777bfa50cf5ed1c0ddea2c74a3c27d05310087a33ebfcaa6d8df71e8cdce46eab703d4299a

  • SSDEEP

    3145728:qbzHAlMRvSvTXKX5U1LAcHbBlpmDHxc20Z/s:iTAmcLXKsxr2R4Z0

  Score

  10^/10

  observerstealer

  • Observer

    Observer is an infostealer written in C++.

    stealerobserver

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2