Extracted

• • Target
    USDT Flash Software Private 2.2.exe
  • Size 9.1MB
  • SHA256 706e366d31c8c814693aaa6a0566afbc12c25de67aaa50629e14ddcaf8e32c4e
  • MD5 5aa6a0d5da2ec5df18edac11e850ba1e
  • SHA1 4734a5948f8979b05bdb93b6b92e301be5fd8bdc
  • SHA512 eee86884474aa96138745f7f165b2bf9245ad0ad41223a157c09d53a3129f790f7d371f3ba96fa06030244cc9c8bb117d86f1de2182f668ebdf458a06b12ea3e
  • SSDEEP 196608:zDSPEefP4bJxwLYYHdbu9v+D0HiouWJysVYvsOaoyMxxvjDDAx0a0GjdN:XMZX4lPYHJ2hHi9WJdoyMxtDDAxoG5N
  • TLSH
    T122A6231172C104F1FAB75138C8A08404EE72B86607E1A15F5FF5DA6E6F376E0AD3AB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsvcstealerinstallerpersistencepyinstallerstealer

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2