Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 02:50

General

  • Target
    KikoFluEdge-windows-setup.exe
  • Size 21.6MB
  • Sample260810-dbspsszdnf
  • SHA256 ad1347e83857cd6d1d1e4a362c08fdd295f390606d5274ca37b580c76340efea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 62 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KikoFluEdge-windows-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\KikoFluEdge-windows-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\is-UIT6HGT9DT.tmp\KikoFluEdge-windows-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UIT6HGT9DT.tmp\KikoFluEdge-windows-setup.tmp" /SL5="$1101F4,21432960,893952,C:\Users\Admin\AppData\Local\Temp\KikoFluEdge-windows-setup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Program Files (x86)\KikoFlu Edge\KikoFlu.exe
        "C:\Program Files (x86)\KikoFlu Edge\KikoFlu.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        KikoFlu.exe

        • Path C:\Program Files (x86)\KikoFlu Edge\KikoFlu.exe
        • Size 334KB
        • SHA256 a6543c739192d309c97ccd89ef2965bc4795fffe2ef8054108facb893e0ad4e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        connectivity_plus_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\connectivity_plus_plugin.dll
        • Size 95KB
        • SHA256 701428209f9c70bcee667c38a416255897632f90474e51e577a52bb4522c1107
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.so

        • Path C:\Program Files (x86)\KikoFlu Edge\data\app.so
        • Size 18.2MB
        • SHA256 65ec7d200d79436d3dde5269a33f6c3634b719003e809c23ed336b9a91d240cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssetManifest.bin

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\AssetManifest.bin
        • Size 1KB
        • SHA256 627e17381952015f07dc029d9b3180d28dc1adb86f55a0cfba11e7e5fd07917d
        • MD5 SHA1 SHA512 TLSH

        FontManifest.json

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\FontManifest.json
        • Size 282B
        • SHA256 b080449b6ae93a691df4f2fb5e25cce5ee1416bdeecf3023134ddc596ec5433c
        • MD5 SHA1 SHA512 TLSH

        NativeAssetsManifest.json

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\NativeAssetsManifest.json
        • Size 131B
        • SHA256 4ac70f7d67abb2ffc105d2cabfdee68c9aa138d132107e5be4949c539f7ce379
        • MD5 SHA1 SHA512 TLSH

        GoogleSans.ttf

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\assets\fonts\GoogleSans.ttf
        • Size 129KB
        • SHA256 ece53e6cca855f01d759722d01bdfea7f1d80fb219399a8a98be00a1fcedd269
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icon_login.png

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\assets\icons\app_icon_login.png
        • Size 12KB
        • SHA256 a76cd35a72fd48dae8f9927dc116147527a8a48c15e4aca71d41ac57d6ca9bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icon_opaque.png

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\assets\icons\app_icon_opaque.png
        • Size 10KB
        • SHA256 5473e793ba0542d3104333a7128ef6669f23c838d8c5baeac45a6fc064bdfdac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MaterialIcons-Regular.otf

        • Path C:\Program Files (x86)\KikoFlu Edge\data\flutter_assets\fonts\MaterialIcons-Regular.otf
        • Size 1.6MB
        • SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Program Files (x86)\KikoFlu Edge\data\icudtl.dat
        • Size 842KB
        • SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop_multi_window_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\desktop_multi_window_plugin.dll
        • Size 131KB
        • SHA256 89055d9d21c979673e14341a58eecfd966603321892e5fd6b1aefff3ed5afa6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dynamic_color_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\dynamic_color_plugin.dll
        • Size 78KB
        • SHA256 f8b67b9bca72f9e6714e407a7b86f56c3e8bf81ad71f2400e7e98ef839f26be4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_secure_storage_windows_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\flutter_secure_storage_windows_plugin.dll
        • Size 155KB
        • SHA256 c81b90e663dd791f8181662577d87677274e600b15a2c98ee4f26793eb185d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_windows.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\flutter_windows.dll
        • Size 20.3MB
        • SHA256 a147927018fcc1a843fb3938ead58838d2e185ce7d840bc4191a7a1b90c21015
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libmpv-2.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\libmpv-2.dll
        • Size 14.8MB
        • SHA256 0a5a0b476866c91a639a4e511e8153968f8fa23564461b0aa09acdba816164a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        local_auth_windows_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\local_auth_windows_plugin.dll
        • Size 172KB
        • SHA256 f03b7806220cb0550c730517d0bb2da6fb6ab337bb3884162a44bfff3e282866
        • MD5 SHA1 SHA512 SSDEEP TLSH

        media_kit_libs_windows_audio_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\media_kit_libs_windows_audio_plugin.dll
        • Size 12KB
        • SHA256 2e66237a1b1f5b4e8fc1caae6a7be2a51fe655939dd134963a3d597cb2bf745c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        permission_handler_windows_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\permission_handler_windows_plugin.dll
        • Size 115KB
        • SHA256 bf1e4803a4680cbc3a06281c74f9635d47a079fdfcceb1fa63794351f4dc8cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        screen_retriever_windows_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\screen_retriever_windows_plugin.dll
        • Size 117KB
        • SHA256 3ec4d11b4895f089456c09c7410ea275d9b3d9e8ae195bf4f39e33e3753b9c16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        share_plus_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\share_plus_plugin.dll
        • Size 135KB
        • SHA256 1028ffb0f81ba9e0c5a7cba94a05d7ada6f3237feb05d84abd4e2cf5a12e2f51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        smtc_windows.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\smtc_windows.dll
        • Size 269KB
        • SHA256 2c53c3e263608c77b36f339f300e33e841bb4f55136eafe6575c49a6597a3ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite3.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\sqlite3.dll
        • Size 1.6MB
        • SHA256 35a668f1ba0700d3ae2647f09e375bd0335a9fb43decea5fbeb742bc2657abe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        url_launcher_windows_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\url_launcher_windows_plugin.dll
        • Size 96KB
        • SHA256 c959fd16c4d695bf3d3a5cad52450602032489bd248f95c3d70c493f791ce852
        • MD5 SHA1 SHA512 SSDEEP TLSH

        window_manager_plugin.dll

        • Path C:\Program Files (x86)\KikoFlu Edge\window_manager_plugin.dll
        • Size 128KB
        • SHA256 8e5a0f8b54f4d35b891ba1884a20827de0ba8d03626e9c749f774d699a580df7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KikoFluEdge-windows-setup.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-UIT6HGT9DT.tmp\KikoFluEdge-windows-setup.tmp
        • Size 4.2MB
        • SHA256 c633e41d5ac7f07175b7f113ba9ba77e7916e8d8b8324b366b25c2ee4e32eda5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_secure_storage.dat

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\flutter_secure_storage.dat
        • Size 502B
        • SHA256 2095adc7af0e6fe6a16ad35656940d7794a16bb0e214dd40cb41e8ecdd28a7ff
        • MD5 SHA1 SHA512 TLSH

        flutter_secure_storage.dat

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\flutter_secure_storage.dat
        • Size 582B
        • SHA256 d59f35369c6791df25edaf53a6c384bfc06ead6cfb941c51699f19e936e551ab
        • MD5 SHA1 SHA512 TLSH

        flutter_secure_storage.dat

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\flutter_secure_storage.dat
        • Size 294B
        • SHA256 4ea4abd063db20faf6807e9294c2d50d7d457e65d25642836e84e9784d962ba5
        • MD5 SHA1 SHA512 TLSH

        shared_preferences.json

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\shared_preferences.json
        • Size 31B
        • SHA256 533b9eed8e7d7dabe73255378f5ab7e81e0c9991ee04d6808b5bec3b1bd4c6f3
        • MD5 SHA1 SHA512

        shared_preferences.json

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\shared_preferences.json
        • Size 1KB
        • SHA256 301d37030aecbfbd8323e1b9cea01071bbea5388d25cf66605bf5bee6bf658ab
        • MD5 SHA1 SHA512 TLSH

        shared_preferences.json

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\shared_preferences.json
        • Size 1KB
        • SHA256 f4877230bb801a041e43a4c799a52bba57c725b2c745a6f0e4e8400cf7d01cee
        • MD5 SHA1 SHA512 TLSH

        shared_preferences.json

        • Path C:\Users\Admin\AppData\Roaming\com.meteor\KikoFlu Edge\shared_preferences.json
        • Size 2KB
        • SHA256 28561903c20a38e41a8a1b082bc15b9c8a0399f7adb78401c62449ba0fe59f6b
        • MD5 SHA1 SHA512 TLSH

        app.log

        • Path C:\Users\Admin\Documents\logs\app.log
        • Size 1KB
        • SHA256 1d6335490104884b323081c505559a808780ead7b8b680bed3b1847e2763e665
        • MD5 SHA1 SHA512 TLSH

        app.log

        • Path C:\Users\Admin\Documents\logs\app.log
        • Size 2KB
        • SHA256 13a243d0304a03469c2f2ceffb38d4914fe4b682581d27576efec3144962cfa1
        • MD5 SHA1 SHA512 TLSH

        app.log

        • Path C:\Users\Admin\Documents\logs\app.log
        • Size 4KB
        • SHA256 df1e302f33dc28fedacf3103b469bc6e11e1061e223b665d6bf81bcf9ff064ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/744-131-0x000001D8290E0000-0x000001D82A30D000-memory.dmp

        memory/744-133-0x000001D82A310000-0x000001D82A311000-memory.dmp

        memory/744-137-0x000001D82A480000-0x000001D82A500000-memory.dmp

        memory/744-129-0x000001D8290C0000-0x000001D8290C1000-memory.dmp

        memory/744-130-0x000001D8290E0000-0x000001D82A30D000-memory.dmp

        memory/744-136-0x000001D82A480000-0x000001D82A500000-memory.dmp

        memory/744-132-0x000001D8290E0000-0x000001D82A30D000-memory.dmp

        memory/2224-28-0x0000000000340000-0x000000000078C000-memory.dmp

        memory/2224-29-0x0000000000E10000-0x0000000000E11000-memory.dmp

        memory/2224-142-0x0000000000340000-0x000000000078C000-memory.dmp

        memory/2224-141-0x0000000000340000-0x000000000078C000-memory.dmp

        memory/2224-5-0x0000000000E10000-0x0000000000E11000-memory.dmp

        memory/3936-146-0x00000000006E0000-0x00000000007C9000-memory.dmp

        memory/3936-0-0x00000000006E0000-0x00000000007C9000-memory.dmp

        memory/3936-27-0x00000000006E0000-0x00000000007C9000-memory.dmp