Extracted

• • Target
    combo-toolkit v3.0.exe
  • Size 41.9MB
  • SHA256 85c140fe82fce1988bf4d0ca4d18013cc70929e400400ae7e3da2dc06b298f3c
  • MD5 6d6ce5ece59f50f53d9a921f5c01fdcf
  • SHA1 b5c505dd1e98997e25a82b9d619e47986dec7065
  • SHA512 2158bbe749e70df84ebbcbe0409fea8a13bc69def58d044a56b5f243aa5d455d3d12133f6673e5a03763a28399da6e71c6e73da42ff0107f33ef4a8488345db8
  • SSDEEP 786432:7SEqhdtDuK1k4t5s0fNk4toojCCiARpUs4knyPrgDg4/:4HtDuK/lfHyomCiARWsRdg4
  • TLSH
    T198A733D4B5B706E6F87196F8126CC312A5205C2CAF1C261D83C99CACAE75EF60D9DE13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionsvcstealerinstallerpersistencestealerspyware

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2