Overview

overview

8

Static

static

3

OperaGXSetup.exe

windows10-2004-x64

8

OperaGXSetup.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 17:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OperaGXSetup.exe
  • Size 4.0MB
  • Sample261002-v73cjsvvgy
  • SHA256 daa0cc25f71abb8a9df0ca9cb148fe838fb8747c3664f559edecc1961e56ac50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5564
    • C:\Users\Admin\AppData\Local\Temp\7zSCB567209\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCB567209\installer.exe --server-tracking-blob=MzZlZTUzOTlmOWZlOWU1NWRmYTgyMWQ3MDliN2RlZDYwNWYxNGZlN2IxMDRmYjBjNGM3NTVlOWM4NTYzOWI4Zjp7ImNvdW50cnkiOiJSTyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9ST19TVlJfOTQ4Ml9XRUJfNDYwMSZlZGl0aW9uPXN0ZC0yJnV0bV9pZD1mNTE3MGExZGFjMmY0ZTgyYThkY2U1NDdjYTE5YzEwZCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX1JPX1NWUl85NDgyX1dFQl80NjAxJTI2dXRtX2lkJTNEYzI5YjliNmMzNzVlNDdhMGIxYWQxMTlmM2UwNTg0OGQlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9YzI5YjliNmMzNzVlNDdhMGIxYWQxMTlmM2UwNTg0OGQmZGxfdG9rZW49MjMzOTEwMDQiLCJ0aW1lc3RhbXAiOiIxNzkwOTYyNzA2LjYyNTEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTU0LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzE1NC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9ST19TVlJfOTQ4Ml9XRUJfNDYwMSIsImlkIjoiYzI5YjliNmMzNzVlNDdhMGIxYWQxMTlmM2UwNTg0OGQiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0Njc2NGI2ZS01MTE1LTQ5NDYtYjljOS02Y2ExYmQzN2E4MDgifQ==
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Users\Admin\AppData\Local\Temp\7zSCB567209\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zSCB567209\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff6b56e7998,0x7ff6b56e79a8,0x7ff6b56e79b8
        3⤵
        • Executes dropped EXE
        PID:1272
      • C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\installer.exe" --version
        3⤵
        • Executes dropped EXE
        PID:5600
      • C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • Writes a Windows system DLL name to a user directory
        • System Location Discovery: System Language Discovery
        PID:5016
      • C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x3dc9cc,0x3dc9d8,0x3dc9e4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:772

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Privilege Escalation

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Defense Evasion

        Hijack Execution Flow

        1
        T1574

        DLL Search Order Hijacking

        1
        T1574.001

        Masquerading

        1
        T1036

        Match Legitimate Name or Location

        1
        T1036.005

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        additional_file1.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\additional_file1.tmp
        • Size 2.9MB
        • SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        assistant_installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\assistant_installer.exe
        • Size 2.5MB
        • SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        browser_assistant.exe
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\browser_assistant.exe
        • Size 5.3MB
        • SHA256 4d033b0d0804e98418d736c57aef51d502bc131637e688a8381f2b8133a5856b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbgcore.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\dbgcore.DLL
        • Size 196KB
        • SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbghelp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\dbghelp.dll
        • Size 1.8MB
        • SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        files_list
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\assistant\files_list
        • Size 72B
        • SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        custom_partner_content.json
        • Path C:\Users\Admin\AppData\Local\Temp\.opera\42c9520b-798e-47da-b44b-04aaad66cb5c Opera GX Installer Temp\opera_package_202610021839161\resources\custom_partner_content.json
        • Size 245KB
        • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zSCB567209\installer.exe
        • Size 9.2MB
        • SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
        • Size 40B
        • SHA256 e491c16d0d835069832ae6aeb141cc55fa48289a0be203bd018887c3b2e5bcec
        • MD5 SHA1 SHA512
        Submit Download