Extracted

• • Target
    OInstall.exe
  • Size 10.9MB
  • SHA256 414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
  • MD5 ebc58647462ad9c76395ef451064d115
  • SHA1 14e470812f13b278b2694a4cec5737a39784e9dd
  • SHA512 8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
  • SSDEEP 196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
  • TLSH
    T111B63376044290B6E0812DB6520EB4F5661E3857189BFC642D4BCDE87BBADC3D7D2A0F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionspywarestealerupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1