Extracted

• • Target
    Setup.exe
  • Size 14.1MB
  • SHA256 e36f4b3fe1df6c53ddccab621513caf56c1b8fe04437778c5566b86f5f0f753a
  • MD5 6ca9deb4f5a024ada0f16859a0394480
  • SHA1 1022a10a6ad39530550ce314f6fda8a3999e4f16
  • SHA512 f9b6c20eec082fb336933b758bc147472946365d0fd12476afe019d923f4fae56beee279dee3d9c99ae8cbc5892f97d109c094c628efd8205a24bd75aa9d0ed8
  • SSDEEP 393216:I0xHQJkeRBp6fPGY9ZwUE3YEPQNnbpl2bb5LYaiUEP0:IxJkC6G6wUEIZtplklcaiUT
  • TLSH
    T10BE6330A634422FDF022C9788A89E711E7707C558731DE9F53E8E95F2F43290A52EB76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2behavioral3behavioral4