Extracted

• • Target
    TMSSetup.exe
  • Size 7.3MB
  • SHA256 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43
  • MD5 e0efcd15daaa87d864f56c803156ae43
  • SHA1 5327dd70591fd8687b5514c44c3604d1728f909e
  • SHA512 d2fd47faeda11445fe247a2e5ae4c6149ecee9a64d585712bf283e38a0c1f25ae9a0eaf86e41e0f5aa665588959219523c23da2c30269307f2aef302df7c51ce
  • SSDEEP 98304:flyRuief75kCNgW3+MLIndoQLW7pyPPfUZMoHFY2yZSg4RYY0yO:f4Ruief6+3FsHfC6R4RAx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverycleanuploaderpersistenceprivilege_escalationtrojan

  • CleanUpLoader, Oyster, OysterLoader

    CleanUpLoader aka Oyster is a remote access trojan written in C++, first observed in July 2023.

    trojancleanuploader

  • Cleanuploader family

    cleanuploader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2