Extracted

Extracted

• • Target
    owomario Gen Pro Setup 2.0.exe
  • Size 162.0MB
  • SHA256 4e549f6349a4daf49b921f8ad7bec2cfc4fe61db568a614deb6749a3682c1384
  • MD5 7a9920a29733dbe55f9516642bc73c1d
  • SHA1 c51b0380f78a039f26f34d3c7c2ef1342187504d
  • SHA512 5d330827dbcc2047a9d753e5b25a6c122695974249bef8f95d6e1581c3ea2cb3c2862cc937a73fb16cd7459c13c1da386bed72e6c91c984578149a837e975e7c
  • SSDEEP 3145728:vBLNGZvyqbP8RPFW216lCLV1Ovl+5pj/fcRv/MbMLRi2LldXZdTE39cSiLlhc:1NGVyqbURPr5LVoU8RMQLI2BdLE9cSok
  • TLSH
    T1D5883350F50AA0EBC1721973D1B0BBD497D8FB7103A8E0920573EAC6796912CBA5F7D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecution

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/StdUtils.dll
  • Size 100KB
  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
  • MD5 c6a6e03f77c313b267498515488c5740
  • SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
  • SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
  • SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
  • TLSH
    T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
  • MD5 0d7ad4f45dc6f5aa87f606d0331c6901
  • SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
  • SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
  • SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
  • TLSH
    T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/UAC.dll
  • Size 14KB
  • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
  • MD5 adb29e6b186daa765dc750128649b63d
  • SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
  • SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
  • SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
  • TLSH
    T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/WinShell.dll
  • Size 3KB
  • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
  • MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
  • SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
  • SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
  • TLSH
    T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    $PLUGINSDIR/app-64.7z
  • Size 161.1MB
  • SHA256 ff603e96ec827c4a1a45d3e7b037358be3f2df03c11be45958b71e146cba3498
  • MD5 1d48f0a2e126acff2019b25c1db81368
  • SHA1 75f9ee8c8cd3e0fc2752c0357e2b87a411d79a5d
  • SHA512 f073b99b80c0c6718fb7b15eb5bb6db8d59786979f825a3649613ecaecf0cedc7d4da81ac5e26b6c72dd00844dea75ccc6df549126ad83699cf843afd3506d34
  • SSDEEP 3145728:xLNGZvyqbP8RPFW216lCLV1Ovl+5pj/fcRv/MbMLRi2LldXZdTE39cSiLlhH:tNGVyqbURPr5LVoU8RMQLI2BdLE9cSof
  • TLSH
    T11E883350F50AA0EB41721973D1B0BBD4D7D8FBB103A8E0920573EAC6796912CBA5F7D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    owomario Gen Pro.exe
  • Size 215.1MB
  • SHA256 dcfa6a8277e0921a60cff8896e81fa6bb74aa8e077b2a7a0ca2594fb5bf90354
  • MD5 3d080ca822b50fa5d4db27a7574d823a
  • SHA1 66bb248463d6b29d7c938b56893e6880b66d07a2
  • SHA512 4bb8bbfa4701a39fe3b989d33670c1e92ceb90eb630db466c59d27b7fd410904de7e53c78dfeb16e12828cc6fabddd26aac293c0b4f071b08c3f3c9bbc4e6dbb
  • SSDEEP 1572864:ZOa3GJV1iPuKYncvg3LOL9Yez2OTe1lKrnzGjxuJm0p6TQLCfTQFHk4KmntuykGK:YximKYn2KwgF8V8
  • TLSH
    T1EFB88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447522F66EF82B3DB20
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  executionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer
  behavioral13
• • Target
    resources/app.asar.unpacked/node_modules/@cemalgnlts/mailjs/dist/mailjs.cjs
  • Size 6KB
  • SHA256 abcef4030095ff9473c3723cea5b249c5dc2fc0e03419f87a49e34bae774d6bc
  • MD5 f89ce8b78a68de598b6f1f751b64df1c
  • SHA1 3d7be961bf9935940018956505154c4098d7a39c
  • SHA512 8dbb7a881ef7f1ae9551244f7d4392bf04805c86cc5a8ab8ef14bab228a83faee2ab0e1714a5c9e308f89aa83af253e768b385ca209574818250a2783eeed9ac
  • SSDEEP 192:oSS5/X+HZPI998Gvj0OLYrCcSCZePxM74GQ9TLZoNPDJlsw1hHwJ/+dhB/sanvJ5:mAZIix/j761WKCk9o
  • TLSH
    T19CE1FE4916F7211A0AA7B12EBF2A70063038E4471549E81CFEDC47D96F8897A95F1FE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral14behavioral15
• • Target
    resources/app.asar.unpacked/node_modules/@cemalgnlts/mailjs/dist/mailjs.min.js
  • Size 2KB
  • SHA256 bd3d3a12db610f14a9688de6068249cf229cf591c3a8f7ed1a02f5333ae15ced
  • MD5 37a71869da91ed85829922f4183affa7
  • SHA1 4e527112bc5a3d7ba42003cebbdf05a0ca3fe73d
  • SHA512 1357f9889f04d29acd081836b208cfb75de24021c65779bb5b2d8291ec1f0240b7d9e4b5846e250d045224d82a275e2e169e5eb5c8c301a9a9aa304418f58c1f
  • TLSH
    T1BE510ED832E7B49906C4E8ABF934325A9108DCC1244D101DFAAC6CEF2B91C51B935F38
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral16behavioral17
• • Target
    resources/app.asar.unpacked/node_modules/@cemalgnlts/mailjs/dist/mailjs.mjs
  • Size 6KB
  • SHA256 188431230717d9914256fa2fd921368efba94a2d7c7f6eb22cd4f8c8d45353ca
  • MD5 6a173236d57d0f2847d393c6f2292fde
  • SHA1 bcd00fd0c0a343ff3853cc45cbee4b97f871c166
  • SHA512 3f3179fabe98aaeaa3e1baa8f1da3ff55ee45bcc8dea95fe55c944eb97b60d5743059d7064cfe0e4423a317c95e12e616ed173eb92a93c8670c385ebf6c0615d
  • SSDEEP 192:OSS5/X+HZPI998Gvj0OLYrCcSCZePxM74GQ9TLZoNPDJlsw1hHwJ/+dhB/sanvJg:8AZIix/j761WKCkx
  • TLSH
    T14EE10F4916F7611A0AA7F12E7F1B70063038E4471509E80CFE9C47D96F8893A95F1FE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral18behavioral19
• • Target
    resources/app.asar.unpacked/node_modules/@noble/hashes/_blake.js
  • Size 2KB
  • SHA256 cabbff61d1f373bac45594ad758df7c42e176464ddbb94b44f5533fa977a4f56
  • MD5 142c233301616a4f9c8bf21d3ec28c91
  • SHA1 17034c710a3f1fad12e0a515b73cb089ba947264
  • SHA512 d9cf123d7f4b7c551833ea2832682363dcb3b0e3ba60ce837d5cb3f8e99db611610322dd5047ed807ca9bc3b7661fd2529c93087f48bed88c60349583ac94753
  • TLSH
    T11651BB436F4429AE411EF974AAC7AC47D7C8C067293F7987F14E4091AF9CC294335E86
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral20behavioral21
• • Target
    resources/app.asar.unpacked/node_modules/@noble/hashes/_md.js
  • Size 8KB
  • SHA256 60cf3010fda89e3e4d3f0e7ff1ce249e9c467f34b4fd41b6fd6101d9f69be763
  • MD5 f07578ae29d238c50303726bb317ab23
  • SHA1 ddc1b79385308e4ba965bf04dbe0ca82f314c7cb
  • SHA512 b33a7a2c37d2751f0da2c2934aa908174aa611db1b1c4e686df60e3abf285878105b6aeff0cc77c74e5f30ad903b4d863f903732768eab05895667600364661a
  • SSDEEP 192:NgoT9DMZIT8ymSp0t+DdYalXwEERFiD9WdgdJD:Nxaly0tO6ap8avD
  • TLSH
    T1DB12C85A5BD212B78A6372D2AF4EA4526250B00B7F12C098B44DD7942F8E43C87F6DD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral22behavioral23
• • Target
    resources/app.asar.unpacked/node_modules/mailparser/package.json
  • Size 864B
  • SHA256 f27df4b2a8d299c4b4d6d0c84a0d52fbb0713bb5dc4562b0ef3be06545525606
  • MD5 dd3fa51a360fad8c97c3c1a423587ddc
  • SHA1 53af8bf805a10af7172829a40483d2ae17bf609b
  • SHA512 60300ca70e65c29df69d88e77fd55428b91dcb398748d1ff499689ec42e71602d978e591501376af956bb6fa8a4569d91b905f31170d33572da4d905354415fe
  • TLSH
    T187116630D7194EE327C81ADDB8511253621138070D96BC0DBB52201CCF9EEDF36BAA6D
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral24behavioral25
• • Target
    resources/app.asar.unpacked/node_modules/mailsplit/LICENSE.EUPL-1.2
  • Size 13KB
  • SHA256 1dc969d706e1c7f06961186aadb674ed4886a669fe91b31914ac4fd8dbec83dc
  • MD5 a860133e567784deb678ca3504cc3e1a
  • SHA1 17348b53a4860f6d9ca69a812d27e0438eb9e554
  • SHA512 59eaf09c050b543d7523140c0d95a469b84bf98881d78c64ee3ae6b89210178397bbd54273937429b20dee8644b703b767d4eca5fb07cff398650d5761065a40
  • SSDEEP 192:7CvTlSSaNzlWIVXwfwee64X1QbXybsMN67VkwwUWR3JvMAsjrFJdtFRgGRs+xRSH:YlGlbXrKPMxww/MhtF9rxNcIx3NcoC
  • TLSH
    T16252534307F5B24B782803F65B67A5639FF9CE4528240A9F849ECB0516FEA4C3766B70
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral26behavioral27
• • Target
    resources/app.asar.unpacked/node_modules/mailsplit/LICENSE.MIT
  • Size 1KB
  • SHA256 412ad6764b495ece74454c3b1d1816a4bf9b533f94158d23bfe4342559d8ca46
  • MD5 823ea25479f41382c93dd0d5be4e8337
  • SHA1 1509cc0ada9a5fc37c8040e10f31199b591a4216
  • SHA512 3941f22023bfe3db824f14d21c36aba9e96d4ee855d991f6167dbae79070fb3b49a3cdf817bb50d46849d968e037679197d3ee2595df527978c3e7d4c19975ea
  • TLSH
    T1E111861E735107722CAA23605575A8D9B23BB16B7E9F2A84146EF345133B06CC5FFC44
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral28behavioral29
• • Target
    resources/app.asar.unpacked/node_modules/mailsplit/package.json
  • Size 755B
  • SHA256 dce1575ef98ec858ad411e1ca4c17df9593b0a6c958df7c15001997cead661de
  • MD5 d00c8d74217eeef586bee7310a861e35
  • SHA1 259eb0c49631e65c02901fa4abcd143076a0ffd1
  • SHA512 397e5a20dba74c62890cedac343cee85d2e9d1d473d223e4e79610b4bab0279d4c912bfbbd27c6fae024cd9aade0004a27ff5e578a10c49b966376c7b0d48dbe
  • TLSH
    T142014730C7269CE327D855E9AC492252A21218874C89BD0DB791211DCF9FDDF3ABA67C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral30behavioral31
• • Target
    resources/app.asar.unpacked/node_modules/math-intrinsics/LICENSE
  • Size 1KB
  • SHA256 2b770a704c15de238c3f622b01b0044ddd60b49ee30608ea6991ebf19db7a7a1
  • MD5 a5b1dd92a77a6632ebcc7425b08e9078
  • SHA1 e31a2ce1250664ba02c5b0e523600acc4330ac24
  • SHA512 3d5f0695e3c7e7e61f0b257e4c74987eb744ce825156608f7ad3f71004732b02370678748b49c4df276846f8aabdd75c058424579111179a88c86daa660f05ad
  • TLSH
    T17111861E72544762189B13605575ACD9B13BB15A7A5F2A84246DF241233A06CC5FF840
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral32