hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=Cstza56VKarPzH7jj6tkP_sOZuQO2o-KzhwGp2qOh8hWb6Zy64EAQASD0-cYlYMn-3YbIo5AZoAGl2r6KA8gBBuACAKgDAcgDCqoErgNP0FVbhXnbnsQdTWFZ0dKK843TqBM8kObXnmNWjSrtHU7ptyac5cRoiDpU9t9qrPlUT21qG-klyNHTvjHLAgQTY8rByIUWRb1oiacLDgLHwH6OyMgxhFY_PTOCfAermrq41_vVPTtIZXaiira-PuG7ri2S13JnX04v5Dfy9zeuU5IZ9axy-3_FpjiG4m5lM13lrzVRlHCmcMn6UC4uEkFiKxMORaam0YLUu6HxIsmUKQjH3wBZ5dg4esNM5Le0T4adO8-8XStGhz_ZmXOCCIkWmArGOK9DQ0bQkoAgafIZ4PWhPhsmM8J1zYJVoMX9W3_O2B4un6nf1ojwtvQWpQC_jaB9d7xiH8u9lMDIIUjUeyOu77XPQvI_t3FEmHC-g7z46iQhr1KU1ii8Hd_Ddbu_zpUJyjN_4KJ8k6O4ORu091x7t6RU5NovMUNNwzQMQfJenvy_EdiMWh-zhn40rQZebPOIxsXp2uYt2lI9GWCcs7bJtPr89N01gPamtnwvAiZMYeKCQ5Ml7V9t_gGljV5FYRQQ8pUlzFWWcfsEEYdR8GAkDBGxcaD7CsHzwmXbwASBsI7x1gXgBAGIBYHKiYJXkAYBoAY3gAeE65N7iAcBkAcCqAenzLECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcB0gg2CAAQAhgdMgiAgICAgICACDoUn9CAgICABIDAgICAoKiAAqiBkBBIvf3BOljcgfvPmLyVA2ABsQk49-fvQ9Va74AKA4oKdGh0dHBzOi8vdHJhY2suZ2V0YmFsbG9vbmZpbGVzLmNvbS9nY2xpZC9nY2xpZC1wbGFjZW1lbnQ_dXJsPXtlc2NhcGVkbHB1cmx9JmdjbGlkPXtnY2xpZH0mcGxhY2VtZW50PXd3dy5tZWRpYWZpcmUuY29tmAsByAsB4AsBqg0CVVPIDQHiDRMIhsL7z5i8lQMVuLE6BR3-YSY36g0TCJza_M-YvJUDFbixOgUd_mEmN_ANAogO____________AdgTDIgUBtAVAcoWAgoA-BYBgBcBshcQGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACAqPhAEgozMzQ1MzgzNzc0GAGyGAkSArFfGDciAQDQGAHCGQIIAQ&ae=1&gclid=CjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE&num=1&cid=CAQSpQIAEQoqgdxXiirfpZvHWdnE31oQ5wIox-CPDsHSESfmv-Ftse4r8mCxrR8IR1orBtgAYYHsYNgN_dVthT17uPLK_JfONMLZmLSEGBf-jx5n-rdVWvjYfwwNrVJ-CIwAIwhTZNl-0SiTohkz7CzWg25zziO02Tzh3ZghbAf-dv3dpUURJZyBlyIhQ9rh80OSS6VbVOqq9KDsh16tZhkgwasR45vl9Zf1Xc4Lxq9F-plqrKDcTIBEjaJ4gMc0gZohttY0ck1XZqhoYCJBF7QG_L0fFyX4cbfdd7jIKBnhRVU-FF5OR2PcBJv3EBNxM_qbnZOcULcONCCRPLygg4AxkgltYjscQzcaiT4n5jItEiQ6wve-Khf4qV9KGkmGobPrYRn1IurTXxgB&sig=AOD64_2InOIwtYZV23jQPZawpvJSDJIc9w&client=ca-pub-6396844742497208&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=8&adurl=hxxps://www[.]getballoonfiles[.]com/%3Fbetsdcjw%3Dopifszexpa%26cjwks%3D63728246%26wbusbeju%3Dwww[.]mediafire[.]com%26gad_source%3D5%26gad_campaignid%3D23358235905%26gclid%3DCjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE

Sharing

Copy URL Twitter E-mail

General

Target
https://www.googleadservices.com/pagead/aclk?sa=L&ai=Cstza56VKarPzH7jj6tkP_sOZuQO2o-KzhwGp2qOh8hWb6Zy64EAQASD0-cYlYMn-3YbIo5AZoAGl2r6KA8gBBuACAKgDAcgDCqoErgNP0FVbhXnbnsQdTWFZ0dKK843TqBM8kObXnmNWjSrtHU7ptyac5cRoiDpU9t9qrPlUT21qG-klyNHTvjHLAgQTY8rByIUWRb1oiacLDgLHwH6OyMgxhFY_PTOCfAermrq41_vVPTtIZXaiira-PuG7ri2S13JnX04v5Dfy9zeuU5IZ9axy-3_FpjiG4m5lM13lrzVRlHCmcMn6UC4uEkFiKxMORaam0YLUu6HxIsmUKQjH3wBZ5dg4esNM5Le0T4adO8-8XStGhz_ZmXOCCIkWmArGOK9DQ0bQkoAgafIZ4PWhPhsmM8J1zYJVoMX9W3_O2B4un6nf1ojwtvQWpQC_jaB9d7xiH8u9lMDIIUjUeyOu77XPQvI_t3FEmHC-g7z46iQhr1KU1ii8Hd_Ddbu_zpUJyjN_4KJ8k6O4ORu091x7t6RU5NovMUNNwzQMQfJenvy_EdiMWh-zhn40rQZebPOIxsXp2uYt2lI9GWCcs7bJtPr89N01gPamtnwvAiZMYeKCQ5Ml7V9t_gGljV5FYRQQ8pUlzFWWcfsEEYdR8GAkDBGxcaD7CsHzwmXbwASBsI7x1gXgBAGIBYHKiYJXkAYBoAY3gAeE65N7iAcBkAcCqAenzLECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcB0gg2CAAQAhgdMgiAgICAgICACDoUn9CAgICABIDAgICAoKiAAqiBkBBIvf3BOljcgfvPmLyVA2ABsQk49-fvQ9Va74AKA4oKdGh0dHBzOi8vdHJhY2suZ2V0YmFsbG9vbmZpbGVzLmNvbS9nY2xpZC9nY2xpZC1wbGFjZW1lbnQ_dXJsPXtlc2NhcGVkbHB1cmx9JmdjbGlkPXtnY2xpZH0mcGxhY2VtZW50PXd3dy5tZWRpYWZpcmUuY29tmAsByAsB4AsBqg0CVVPIDQHiDRMIhsL7z5i8lQMVuLE6BR3-YSY36g0TCJza_M-YvJUDFbixOgUd_mEmN_ANAogO____________AdgTDIgUBtAVAcoWAgoA-BYBgBcBshcQGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACAqPhAEgozMzQ1MzgzNzc0GAGyGAkSArFfGDciAQDQGAHCGQIIAQ&ae=1&gclid=CjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE&num=1&cid=CAQSpQIAEQoqgdxXiirfpZvHWdnE31oQ5wIox-CPDsHSESfmv-Ftse4r8mCxrR8IR1orBtgAYYHsYNgN_dVthT17uPLK_JfONMLZmLSEGBf-jx5n-rdVWvjYfwwNrVJ-CIwAIwhTZNl-0SiTohkz7CzWg25zziO02Tzh3ZghbAf-dv3dpUURJZyBlyIhQ9rh80OSS6VbVOqq9KDsh16tZhkgwasR45vl9Zf1Xc4Lxq9F-plqrKDcTIBEjaJ4gMc0gZohttY0ck1XZqhoYCJBF7QG_L0fFyX4cbfdd7jIKBnhRVU-FF5OR2PcBJv3EBNxM_qbnZOcULcONCCRPLygg4AxkgltYjscQzcaiT4n5jItEiQ6wve-Khf4qV9KGkmGobPrYRn1IurTXxgB&sig=AOD64_2InOIwtYZV23jQPZawpvJSDJIc9w&client=ca-pub-6396844742497208&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=8&adurl=https://www.getballoonfiles.com/%3Fbetsdcjw%3Dopifszexpa%26cjwks%3D63728246%26wbusbeju%3Dwww.mediafire.com%26gad_source%3D5%26gad_campaignid%3D23358235905%26gclid%3DCjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE
Sample260705-xegaqae151

Score

8^/10

Behavioral task

behavioral1

Sample

https://www.googleadservices.com/pagead/aclk?sa=L&ai=Cstza56VKarPzH7jj6tkP_sOZuQO2o-KzhwGp2qOh8hWb6Zy64EAQASD0-cYlYMn-3YbIo5AZoAGl2r6KA8gBBuACAKgDAcgDCqoErgNP0FVbhXnbnsQdTWFZ0dKK843TqBM8kObXnmNWjSrtHU7ptyac5cRoiDpU9t9qrPlUT21qG-klyNHTvjHLAgQTY8rByIUWRb1oiacLDgLHwH6OyMgxhFY_PTOCfAermrq41_vVPTtIZXaiira-PuG7ri2S13JnX04v5Dfy9zeuU5IZ9axy-3_FpjiG4m5lM13lrzVRlHCmcMn6UC4uEkFiKxMORaam0YLUu6HxIsmUKQjH3wBZ5dg4esNM5Le0T4adO8-8XStGhz_ZmXOCCIkWmArGOK9DQ0bQkoAgafIZ4PWhPhsmM8J1zYJVoMX9W3_O2B4un6nf1ojwtvQWpQC_jaB9d7xiH8u9lMDIIUjUeyOu77XPQvI_t3FEmHC-g7z46iQhr1KU1ii8Hd_Ddbu_zpUJyjN_4KJ8k6O4ORu091x7t6RU5NovMUNNwzQMQfJenvy_EdiMWh-zhn40rQZebPOIxsXp2uYt2lI9GWCcs7bJtPr89N01gPamtnwvAiZMYeKCQ5Ml7V9t_gGljV5FYRQQ8pUlzFWWcfsEEYdR8GAkDBGxcaD7CsHzwmXbwASBsI7x1gXgBAGIBYHKiYJXkAYBoAY3gAeE65N7iAcBkAcCqAenzLECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcB0gg2CAAQAhgdMgiAgICAgICACDoUn9CAgICABIDAgICAoKiAAqiBkBBIvf3BOljcgfvPmLyVA2ABsQk49-fvQ9Va74AKA4oKdGh0dHBzOi8vdHJhY2suZ2V0YmFsbG9vbmZpbGVzLmNvbS9nY2xpZC9nY2xpZC1wbGFjZW1lbnQ_dXJsPXtlc2NhcGVkbHB1cmx9JmdjbGlkPXtnY2xpZH0mcGxhY2VtZW50PXd3dy5tZWRpYWZpcmUuY29tmAsByAsB4AsBqg0CVVPIDQHiDRMIhsL7z5i8lQMVuLE6BR3-YSY36g0TCJza_M-YvJUDFbixOgUd_mEmN_ANAogO____________AdgTDIgUBtAVAcoWAgoA-BYBgBcBshcQGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACAqPhAEgozMzQ1MzgzNzc0GAGyGAkSArFfGDciAQDQGAHCGQIIAQ&ae=1&gclid=CjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE&num=1&cid=CAQSpQIAEQoqgdxXiirfpZvHWdnE31oQ5wIox-CPDsHSESfmv-Ftse4r8mCxrR8IR1orBtgAYYHsYNgN_dVthT17uPLK_JfONMLZmLSEGBf-jx5n-rdVWvjYfwwNrVJ-CIwAIwhTZNl-0SiTohkz7CzWg25zziO02Tzh3ZghbAf-dv3dpUURJZyBlyIhQ9rh80OSS6VbVOqq9KDsh16tZhkgwasR45vl9Zf1Xc4Lxq9F-plqrKDcTIBEjaJ4gMc0gZohttY0ck1XZqhoYCJBF7QG_L0fFyX4cbfdd7jIKBnhRVU-FF5OR2PcBJv3EBNxM_qbnZOcULcONCCRPLygg4AxkgltYjscQzcaiT4n5jItEiQ6wve-Khf4qV9KGkmGobPrYRn1IurTXxgB&sig=AOD64_2InOIwtYZV23jQPZawpvJSDJIc9w&client=ca-pub-6396844742497208&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=8&adurl=https://www.getballoonfiles.com/%3Fbetsdcjw%3Dopifszexpa%26cjwks%3D63728246%26wbusbeju%3Dwww.mediafire.com%26gad_source%3D5%26gad_campaignid%3D23358235905%26gclid%3DCjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE

Resource

win11-20260513-en

windows11-21h2-x64

20 signatures

150 seconds

defense_evasion discovery installer

Malware Config

Targets

- Target
  https://www.googleadservices.com/pagead/aclk?sa=L&ai=Cstza56VKarPzH7jj6tkP_sOZuQO2o-KzhwGp2qOh8hWb6Zy64EAQASD0-cYlYMn-3YbIo5AZoAGl2r6KA8gBBuACAKgDAcgDCqoErgNP0FVbhXnbnsQdTWFZ0dKK843TqBM8kObXnmNWjSrtHU7ptyac5cRoiDpU9t9qrPlUT21qG-klyNHTvjHLAgQTY8rByIUWRb1oiacLDgLHwH6OyMgxhFY_PTOCfAermrq41_vVPTtIZXaiira-PuG7ri2S13JnX04v5Dfy9zeuU5IZ9axy-3_FpjiG4m5lM13lrzVRlHCmcMn6UC4uEkFiKxMORaam0YLUu6HxIsmUKQjH3wBZ5dg4esNM5Le0T4adO8-8XStGhz_ZmXOCCIkWmArGOK9DQ0bQkoAgafIZ4PWhPhsmM8J1zYJVoMX9W3_O2B4un6nf1ojwtvQWpQC_jaB9d7xiH8u9lMDIIUjUeyOu77XPQvI_t3FEmHC-g7z46iQhr1KU1ii8Hd_Ddbu_zpUJyjN_4KJ8k6O4ORu091x7t6RU5NovMUNNwzQMQfJenvy_EdiMWh-zhn40rQZebPOIxsXp2uYt2lI9GWCcs7bJtPr89N01gPamtnwvAiZMYeKCQ5Ml7V9t_gGljV5FYRQQ8pUlzFWWcfsEEYdR8GAkDBGxcaD7CsHzwmXbwASBsI7x1gXgBAGIBYHKiYJXkAYBoAY3gAeE65N7iAcBkAcCqAenzLECqAemvhuoB8zOsQKoB_PRG6gHltgbqAeqm7ECqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAfVyRuoB9m2sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcB0gg2CAAQAhgdMgiAgICAgICACDoUn9CAgICABIDAgICAoKiAAqiBkBBIvf3BOljcgfvPmLyVA2ABsQk49-fvQ9Va74AKA4oKdGh0dHBzOi8vdHJhY2suZ2V0YmFsbG9vbmZpbGVzLmNvbS9nY2xpZC9nY2xpZC1wbGFjZW1lbnQ_dXJsPXtlc2NhcGVkbHB1cmx9JmdjbGlkPXtnY2xpZH0mcGxhY2VtZW50PXd3dy5tZWRpYWZpcmUuY29tmAsByAsB4AsBqg0CVVPIDQHiDRMIhsL7z5i8lQMVuLE6BR3-YSY36g0TCJza_M-YvJUDFbixOgUd_mEmN_ANAogO____________AdgTDIgUBtAVAcoWAgoA-BYBgBcBshcQGAEqCjMzNDUzODM3NzRQBroXAjgBqhgXCQAAAACAqPhAEgozMzQ1MzgzNzc0GAGyGAkSArFfGDciAQDQGAHCGQIIAQ&ae=1&gclid=CjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE&num=1&cid=CAQSpQIAEQoqgdxXiirfpZvHWdnE31oQ5wIox-CPDsHSESfmv-Ftse4r8mCxrR8IR1orBtgAYYHsYNgN_dVthT17uPLK_JfONMLZmLSEGBf-jx5n-rdVWvjYfwwNrVJ-CIwAIwhTZNl-0SiTohkz7CzWg25zziO02Tzh3ZghbAf-dv3dpUURJZyBlyIhQ9rh80OSS6VbVOqq9KDsh16tZhkgwasR45vl9Zf1Xc4Lxq9F-plqrKDcTIBEjaJ4gMc0gZohttY0ck1XZqhoYCJBF7QG_L0fFyX4cbfdd7jIKBnhRVU-FF5OR2PcBJv3EBNxM_qbnZOcULcONCCRPLygg4AxkgltYjscQzcaiT4n5jItEiQ6wve-Khf4qV9KGkmGobPrYRn1IurTXxgB&sig=AOD64_2InOIwtYZV23jQPZawpvJSDJIc9w&client=ca-pub-6396844742497208&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=8&adurl=https://www.getballoonfiles.com/%3Fbetsdcjw%3Dopifszexpa%26cjwks%3D63728246%26wbusbeju%3Dwww.mediafire.com%26gad_source%3D5%26gad_campaignid%3D23358235905%26gclid%3DCjwKCAjwgajSBhBEEiwASicJUzaqAH3EJNCpCeTp-hC9D_MrD2CPjQTrfUAJwv1qm6w3wIdT1WqjYhoCHeYQAvD_BwE
Score

8^/10

defense_evasion discovery installer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1