Extracted

• • Target
    Setup.exe
  • Size 5.0MB
  • SHA256 499f27061cc38ec593b8104599919c92bb729a55640e6057778a18b05eb7191c
  • MD5 b17e88ed55e2a1d3b8e69e62b3208913
  • SHA1 33b0633c1db65405dad2a3b9257f621c4436747a
  • SHA512 57e5b955ec2f75be6e0b9471ccc48bee24d4ce29a86c33f29aff1df1940e80f0cc251aba918435efc7de9c0f99af8fd48579f456a172377aeb2e919c46e7acf4
  • SSDEEP 98304:06I1HJIrYORXPt7UvLBRXOAmmpBW4tYXefXRwNc7lNEq49X2gaTX9Er:072YORXuNAoBDBNnxVTXWr
  • TLSH
    T1B6362358D7B415FCE1B7E0B4CD928A02F7727C055762EACF5368A5A61F232A08D39723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clipperdiscoveryexecutionanimateclipperremus_stealerstealcpersistencespywarestealerbotnetsocks5systemzinstaller

  • Detect Socks5Systemz Payload

  • Detects AnimateClipper

  • Detects Stealc stealer Version 2

  • Family: AnimateClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4