Extracted

• • Target
    XtremeShell 5.3.1 Setup.exe
  • Size 51.6MB
  • SHA256 421027ca6ffc0e62c1a822bb4522a1885e65981291accafffe76f7ade25cdb30
  • MD5 45ca2bb25d74e4780c49ef1985e5864d
  • SHA1 0407c64bd6bb5babe63f7e31a68fac63e99855b5
  • SHA512 9e3d14597fdb4b42e6b06c4a58a543741e0499841d2bcc2b50d8e5e1ffdb47d4c1a1e8cebbeb6a222aa40dde7e2914708f86b9136dca35d9b75f9db571ba1d96
  • SSDEEP 1572864:Cvm6ZVWNT0pWDIAighFzN4Ayp/fQYoGLnV4TiND3idW:fIVWNT0M8ABFp4NfQ6V42NDydW
  • TLSH
    T1ADC73337B64B217ADD2F46356572A15CC477AE322C13C8069AE4B478CF359B21F2F682
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executiondiscoveryexecutioninstaller

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1