General
- Target OperaGXSetup.exe
- Size 2.7MB
- Sample260719-lt7wfagy4k
- SHA256 5adcd4ca03b95f5ddbbe90c579c79c609fc3b190a86687a3fc5778601df319d5
- MD5 0737ef34ae0c6b685996dfe34816f165
- SHA1 247abb9f9d70e0ec3bb6b832836cd1c43f06488f
- SHA512 468dc34b574d4917f29d85f6893219f89da558e1f849af2113db8358c188ff95102ce2fb02e04247c85bf34c30671e671edbae9b432bf394ba3aca74f06a5193
- SSDEEP 49152:R1L/n1CaRi0XbGXuIKldL9W3hrBXR8s/qyrh07qzlHCzDZgS4Zb1Z9+J4a+YsECT:R1h0c+hrBXR8s/qyn7jLa+YsEC/gmQT
- TLSH T108D58E11A7A801E9D177D338C6565603EBB6B48513319BDB53908BEA3F13AE12B3E3D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OperaGXSetup.exe
Resource
win10v2004-20260513-en
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
OperaGXSetup.exe
Resource
win11ltsc2024-20260709-en
5 signatures
300 seconds
Malware Config
Targets
-
- Target OperaGXSetup.exe
- Size 2.7MB
- SHA256 5adcd4ca03b95f5ddbbe90c579c79c609fc3b190a86687a3fc5778601df319d5
- MD5 0737ef34ae0c6b685996dfe34816f165
- SHA1 247abb9f9d70e0ec3bb6b832836cd1c43f06488f
- SHA512 468dc34b574d4917f29d85f6893219f89da558e1f849af2113db8358c188ff95102ce2fb02e04247c85bf34c30671e671edbae9b432bf394ba3aca74f06a5193
- SSDEEP 49152:R1L/n1CaRi0XbGXuIKldL9W3hrBXR8s/qyrh07qzlHCzDZgS4Zb1Z9+J4a+YsECT:R1h0c+hrBXR8s/qyn7jLa+YsEC/gmQT
- TLSH T108D58E11A7A801E9D177D338C6565603EBB6B48513319BDB53908BEA3F13AE12B3E3D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger