937a3cbf8ed60c5295d19b26ebfd91357cbdf0baa910f8d9815d9cea5391901e

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaGXSetup.exe
Size 4.0MB
Sample261002-vpajtattav
SHA256 937a3cbf8ed60c5295d19b26ebfd91357cbdf0baa910f8d9815d9cea5391901e
MD5 9435a1dc2f739fe8c44b5ec9b416e6d9
SHA1 482926bb4841f9e3c231ce897768ed6d1d27c1a4
SHA512 f88d7ee2fdf3df8789c95deb60018a5b891e70208c6d96eccc093217e095365cb6f99c476f631daac8074574ae39b737e71d4ac04ce66431b46ddabadf8fb796
SSDEEP 98304:cA/PEH19+YvBMia8Wqa7GpK8AY4TkoD64mTdZOYQuR0sQxrk:BPEH19+YvBHajqa7Y1voD5mTnOFIwxrk
TLSH
T13D163363BB845075E69321314FBDF2A847BEB5211FA64A8B77800E6DCF70781AA35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	5228	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
5228	installer.exe
4160	installer.exe
2440	installer.exe
4652	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
2444	assistant_installer.exe
1380	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2444	assistant_installer.exe
2444	assistant_installer.exe
1380	assistant_installer.exe
1380	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\dbghelp.dll	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5228	installer.exe
5228	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 5228	5320	OperaGXSetup.exe	89
PID 5228 wrote to memory of 4160	5228	installer.exe	90
PID 5228 wrote to memory of 2440	5228	installer.exe	91
PID 5228 wrote to memory of 4652	5228	installer.exe	92
PID 5228 wrote to memory of 2444	5228	installer.exe	93
PID 2444 wrote to memory of 1380	2444	assistant_installer.exe	94

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\7zS8C4B80C8\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8C4B80C8\installer.exe --server-tracking-blob=MmU2OTI4YTRjZmY5ZWRlY2EzNTMxMmIwOWMyYmE0YzY3MzJkMzFhMzA3YWRmZjI1Mjc1YTRjZDkzOThhZTU4OTp7ImNvdW50cnkiOiJSTyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9ST19TVlJfOTQ4Ml9XRUJfNDYwMSZlZGl0aW9uPXN0ZC0yJnV0bV9pZD1mNTE3MGExZGFjMmY0ZTgyYThkY2U1NDdjYTE5YzEwZCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX1JPX1NWUl85NDgyX1dFQl80NjAxJTI2dXRtX2lkJTNENTMzZDFmMDkyNzE4NDYwZmE4MzZkYzgxOWI4ZmViYzAlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NTMzZDFmMDkyNzE4NDYwZmE4MzZkYzgxOWI4ZmViYzAmZGxfdG9rZW49MzU1MTAyNDciLCJ0aW1lc3RhbXAiOiIxNzkwOTYwOTMwLjIwNTIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTU0LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzE1NC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9ST19TVlJfOTQ4Ml9XRUJfNDYwMSIsImlkIjoiNTMzZDFmMDkyNzE4NDYwZmE4MzZkYzgxOWI4ZmViYzAiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI4ZDA3NDdiYy1lZWYzLTQyMTUtOTA0Yy0wMjJjYzRiOWJiM2YifQ==
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Users\Admin\AppData\Local\Temp\7zS8C4B80C8\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS8C4B80C8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2a8,0x2ac,0x2b0,0x27c,0x2b4,0x7ff62ff77998,0x7ff62ff779a8,0x7ff62ff779b8
    3⤵
    - Executes dropped EXE
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - Writes a Windows system DLL name to a user directory
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x31c9cc,0x31c9d8,0x31c9e4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file1.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\additional_file1.tmp
Size 2.9MB
SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
MD5 8eed32cc2459d015ed87ad9b787698ef
SHA1 1480a48669504d8f669b76bc64da3f8cabec0cd1
SHA512 acad63ce796ca1d22296d218770c2c66f7b959f71be47aca4014791196684eb01d22c1d1b337dbb058f4d2f5668029dea0b6335efd5ef062d9450c06e2ba7162
SSDEEP 49152:lkinoc7mzJK2Im2Ali492Ob/WJltY0flMg1NK0mdZQGCD17099yIR2PZRPdLBVEu:lkioKr2I6aVj8QB709Ar7PpB7
TLSH
T174D53331BA818875D97312338E6CFBBC68BD76B16FB65DCB77D40B1C8F20552A608192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\assistant_installer.exe
Size 2.5MB
SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
MD5 6f783a3eec7a1f6e3670329ad74bb1c6
SHA1 dc5d8e2003040ae3bf35e09a7f7ba443d67a9207
SHA512 42e8869fdf7ad54bc249e3433d2213d030ba2b59ba51162a21fbf2b6eb4e4c1468a0aad861fa07008604d9cc4fe5ad17e6f5efb9c93510c92ac4ac36dcc9c0f5
SSDEEP 49152:sWhqGl4SUVGhxKdiVjvIKenrYGDiTXnoe6vBnqNXh7B63:saqGl4/VGhxKIxIB5D+XnoeqBqpw
TLSH
T166C5AE02A99094B5DCA63032721CE77D9A355E114F364EC7AB90BCC17FB4AD2613B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\browser_assistant.exe
Size 5.3MB
SHA256 4d033b0d0804e98418d736c57aef51d502bc131637e688a8381f2b8133a5856b
MD5 a5f5aa1006460704553e62b268448fe0
SHA1 e46c82c94ca923a2a35eb7027b6df8d27aea5dbf
SHA512 9bfc3e13065e69868378309a996011093148056a1c4158edb02cc0ad149e916ae02e1f1881ccfd2621f37bc0f1cec96435d21628400d878c412fecbb162a6700
SSDEEP 98304:56666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:VMQ2nHhxdqX1n6TbSO9eKALZykIZ
TLSH
T16246AE52B621207CC84B68B1643D6B7B4C281973972186DFC9E83CE25B749C26E3D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\dbgcore.dll
Size 196KB
SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
MD5 90853f386554492716bce7eb06571fd7
SHA1 e5e1ff295975d3cd50182abddaea26dbde0d79c4
SHA512 0c60587c2266747134e8c7812013ac1a14e8cafaa171452fec9273a796831eacd5effdc7dbbaa0bf254c4502f9076fdbddc9b5f85527b62a236a4f624f8469f4
SSDEEP 6144:VASh0NdOkBakZykbp/eyhr+SJors+k0L3nTd:oYIqFLnT
TLSH
T154148D6296840833DD9F11B8B29F333795FEDFB013A494D362509AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\dbghelp.dll
Size 1.8MB
SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
MD5 f71549450b55a8ba83df14ee3ab5d04d
SHA1 f55dd46aa976283e632c32acc82dd9c68eb1b687
SHA512 b04c7750879dd17db489b790dd2e7be3f35b383a4bb95aff4c900301d48f4d84e6b69f59b0e0bdb12e76711ccb672d9fe7c45c162f7e04d4fe8f4fc18bdf2abb
SSDEEP 24576:YDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsfs:YqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Rd
TLSH
T140856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

custom_partner_content.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\3f479c36-4c21-4e9b-84c1-2f63ba1d163d Opera GX Installer Temp\opera_package_202610021809361\resources\custom_partner_content.json
Size 245KB
SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
MD5 f68d0557a8931cf979a21c59c1bae019
SHA1 e0bfe0f9a947916ebc1fffa52d7dff524e76c2ff
SHA512 2f0ef8e3e11daf0ad266c4fdc35d1e6e2215556115054f635ef9199b03a6924b1aa989f052461d59b9cdf57ec5eafa918e806fbf2d242f63699a8a65b0328ecc
SSDEEP 3072:iwK+GwaiHEaacjK+eMuhKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:XGuE/c9L+1btUYOnkrPVZCCUCabNU
TLSH
T1BA349D7BD4090CE327A561E68879611EEC21D26B0CE97C257B4C254C0F9ED6F25BC2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8C4B80C8\installer.exe
Size 9.2MB
SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
MD5 cf6aca5557b93ff0069de5785c76837b
SHA1 32d52053d00405d48c4a4daad8bdaf53ed63f7a3
SHA512 d5d64718786893701666825963261226b6cccc6a557d226812376af60d542db1314cca351db6a58f80b4476974bac898aca8aadb200895b0ebc59f1fda652bec
SSDEEP 98304:6lkT8NMaZsalrvRje7nSRS0mvX1CFBI3++wteEm+:KkgN9s4Mf0w1h3+Bq+
TLSH
T1BFA69D53F3A601E8D06FCA749B7A5232A9357C464B30A3EF0A943A251E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 4d9f449e331f9b8e05e07c8401074ce60162c43fdbd4c3298f3f036ad63d8ef9
MD5 4296169459b852d48767881419236f22
SHA1 b6f164d8d8bce6b68478c647283151683c612e9e
SHA512 b5d5b833e73c186f662135ae039564e0e4e829da1836b797214ba7b9076f466653427122b2b6e6ef91f0bb7abd4dfc35af629a7c348fedc214bd07961d3cebc2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads