Extracted

• • Target
    Setup.exe
  • Size 22.4MB
  • SHA256 5c823f7f4bbe35f6e87b71112b22b97d7b7335dbc3a2c8630814f77d45062df2
  • MD5 97604eaa0c7671c85336cb11e0e35567
  • SHA1 99030d8a12df127541a358bd3635bcbe7292dc27
  • SHA512 e53ff6c90c2e6f195818aab95e8c4c719293d18ddf3d3903e579df70b53666495a4a4e61152c115a60b7115e6aadf05922a807376c2e248f3b631ecb56e218c9
  • SSDEEP 196608:1zHfiR+PhfgFByzvEv0q97sISZKsQoygNJsv6tWKFdu9CM+wx/:1za8PhIFBkEl7Bp0Jsv6tWKFdu9CM+e/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3