Extracted

• • Target
    OperaGXSetup.exe
  • Size 16.9MB
  • SHA256 76b4ff0b016bc7a960b12d7c7eb69ffa5c5ead530368d3a771643775e6553121
  • MD5 f07363243df850d00e91dcc456f5d980
  • SHA1 4ee7280a5af4b5d11e36d028b303d76c30e1ee68
  • SHA512 a200904a4a8347686de5b5b7e1f647f3213e9bc72f23406422bf1ccf64dc14566242f97cd26fe3b3e5a7b79f72c932c515c802ebb41a10804917e94cbf5287e9
  • SSDEEP 393216:EqyCrd0n16INdq1B7LERYgDmHsn4qSyc0piG7PzPpW:Eq5rdq16INg1CsgzSn0p5zPA
  • TLSH
    T12D07339107C20666FAD7F13E16B29592D2A1B4902F3199EF0B64536B3F7B0E19C3B781
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionspywarestealerupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    script.pyc
  • Size 79KB
  • SHA256 55232a88ea52a16afa61f2b563691a04d7a2d1d75a86f511efa97f830050441a
  • MD5 43746396179262dcfaee40a2864511c3
  • SHA1 746ae83dd4c3382fa6cb21cd2d09b97a471d5fb9
  • SHA512 4e3f25bedbbbcb2dbe37e7469dfdc4034235558aaba2be1a72ba1c7b2cb0e679de53269772c18e1389cf7d41cc42313652be5fcfaf1ea14962e316b2d5b3b011
  • SSDEEP 768:gsj3UNrftMaQ7iZC73yF15UybGTHKmr8FuQSr1BGUnQNyC9aRD5+WgC/vbq2x:gsz4rf5S3yFhbGTFAZ4CwxVp/vbq2x
  • TLSH
    T15C830A74BA347127EDD8F13C74E2E9D56722868A7641D343F518AD38BEC930AED5120E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4