Extracted

• • Target

    Valid8Proxy/Data/Modules/Checker.exe

  • Size

    9.9MB

  • MD5

    a609164d1658cf3bdd653a05865f5eae

  • SHA1

    487232488b7d1c4af50c19e2c641989fe6f98911

  • SHA256

    f63016e0eb409846aced10ccc9a632cd6ff567a76eafb659b3a23e48a79dbacc

  • SHA512

    49d50a708596bd8823a3e203669a4369dd81545d8416122284d7b26d26502d3c7627ef150a76d8224507e77ec0e8ca1e8306acd411f07ebb6902d367b3129cfa

  • SSDEEP

    98304:uglet6sFODTir3/pi9Arhsmu+bPBEOWGgbZm9Fzl:ugxsFODGrschsmumPCxUz

  Score

  6^/10

  persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2

• • Target

    Valid8Proxy/Data/Modules/Checker1.exe

  • Size

    12.1MB

  • MD5

    c80d62ea9392b55404d34513ea87aac8

  • SHA1

    47fbed6b45f7ec59f64f2328cb5c2397102fcbf2

  • SHA256

    0ec753374174c21ad50f39c68611bab1fc687c8359c2fe8d5cdb24c9c859fa77

  • SHA512

    3f9a47489b66e8f9a093b69bbd7a4d3a4793fcab24a48a86233244b4a7204a7eaa4b0e93078632b4131f7275970189b7aeb41bc395a9798ce989b63f949c6511

  • SSDEEP

    196608:99EaY7HakrIK63UtauZijIXMCHGLLc54i1wN+gPIcu9KYK39shSEo3PPyIkMeKOO:IPae63hucsXMCHWUjvcuId9/PyjrF

  Score

  7^/10

  • Loads dropped DLL

  behavioral3behavioral4

• • Target

    Valid8Proxy/ProxyChecker.exe

  • Size

    582KB

  • MD5

    82c493c58ad0ed2255d1500840d1d75c

  • SHA1

    24b2997983add8d90e896af2dbdc32cf19895389

  • SHA256

    325a912d9f9f4878cfc13a45a2da2494b4c4080c39d8a40166eb39c6ef3d24a0

  • SHA512

    68f91fe3693dffdaadf28ad5dd3719cdfddff6e4729f48774ae336aef97908d8bc2c419aff65a7d4cbe24e2b85ea2f311dfec2de1136ed7fd7374d2d3ead8c88

  • SSDEEP

    6144:oOaTmuaJ0GFRabVg8O1lFrRawLmKx85EJXlkc3rNPWyXJJy1LDR6qwYelXN1C4q1:oOSmvFobVgZtCKZX97NPWyXgteYILQ

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral5behavioral6