26bb11eda4879dfcec579835c2e2a4240bd115415919d9934199be2d442bfc58

Resubmissions

04/02/2025, 00:25

250204-aq1r6sylfx 7

03/02/2025, 11:18

03/02/2025, 11:18

03/02/2025, 11:08

03/02/2025, 11:05

03/02/2025, 11:01

Sharing

Copy URL

Twitter E-mail

General

Target

OperaGXSetup.exe
Size

3.8MB
Sample

250203-m8k6nayrdx
MD5

5b8cb1947781b81771c8ccce8c2acf9c
SHA1

dac0a7b542a624c851bb182af26ad4540f9b3662
SHA256

26bb11eda4879dfcec579835c2e2a4240bd115415919d9934199be2d442bfc58
SHA512

70ace2d4fd39fa3923cca59f80a085025ad5c5477d873beef61036ee9590ac77a2a670d23cd149691b194e2b20f96661af8dd5d795a61bf9cfe31ff0c65d43c8
SSDEEP

98304:IA5YT8y844FnN4ChLeQEGfleiLdAXmjTjiMI:4T8y/IrBr5f3LU2ml

Score

8^/10

Malware Config

Targets

- Target
  
  OperaGXSetup.exe
- Size
  
  3.8MB
- MD5
  
  5b8cb1947781b81771c8ccce8c2acf9c
- SHA1
  
  dac0a7b542a624c851bb182af26ad4540f9b3662
- SHA256
  
  26bb11eda4879dfcec579835c2e2a4240bd115415919d9934199be2d442bfc58
- SHA512
  
  70ace2d4fd39fa3923cca59f80a085025ad5c5477d873beef61036ee9590ac77a2a670d23cd149691b194e2b20f96661af8dd5d795a61bf9cfe31ff0c65d43c8
- SSDEEP
  
  98304:IA5YT8y844FnN4ChLeQEGfleiLdAXmjTjiMI:4T8y/IrBr5f3LU2ml
Score

8^/10

discovery exploit motw persistence phishing privilege_escalation spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Drops file in System32 directory
behavioral1