Extracted

• • Target
    ChromeSetup_v1.3.87.370.exe
  • Size 1.2MB
  • SHA256 40678643ade16f4bb14659ab1918206f588ed8bb1d64a44b519b8c99a5bb80df
  • MD5 2b62dd154b431d8309002d5b4a35de07
  • SHA1 2216268cd5af2036f5904bb394caef475ea12e6e
  • SHA512 93d101ca706faef9a8967d229b2ff500909ea6a51e010e8b620f5cbc568188b172e25325ea7d0eccb62fa0584ae5d125daacc9588bb6a65aad69f0cde5ac0fe0
  • SSDEEP 24576:N5xO1W494JjgIt+3/7BtKK9lIFeu0NBXcajul+t5QiYnWXwkL3yrLzUCU5h5/:8W494JjgI0TBtK4lye5BsajuuOPsL3yE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverycleanuploaderpersistenceprivilege_escalationtrojan

  • CleanUpLoader, Oyster

    CleanUpLoader aka Oyster is a remote access trojan written in C++, first observed in July 2023.

    trojancleanuploader

  • Cleanuploader family

    cleanuploader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2