d7c8db0cc77faba9f5f76e696508f1f526cb418b2b6cfeb280fa27bc85fbede0

General

Target
olliEcode-Setup-2026.11.07.2.zip
Size 342.4MB
Sample261107-p514tab16z
SHA256 d7c8db0cc77faba9f5f76e696508f1f526cb418b2b6cfeb280fa27bc85fbede0
MD5 e5d143f2a3f265e5d5013cf26966af5d
SHA1 40b970f8c229a887ca1f25d439a7a052e3302414
SHA512 da8094b3bbd5f365709dab0f6b28fdd17b3f43882bfcab479455767128f012c6d68095eca535627b4f3858dbfac5d66c06c5376c93a433262e46105b3b552b03
SSDEEP 6291456:q0RUCPP1GQjeQlhZ2lURzFIo3pM+wxfo7CXJQVNNK/rdZaizRUYLUy:91PVjThfz9ZXIfRXiG/Zlp
TLSH
T19B0933ACB1111ABF9E8582FFBC28DC08042E506F734BCFC8B79663FAD549494F599252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  olliEcode-Setup.exe
- Size 342.8MB
- SHA256 fad857696015f80096f729e0f618af3377f474040caa54894ed0badb40ac9596
- MD5 d0c909104f34de19da3430d28799c4db
- SHA1 6ffc97235aa37e9f34f155d6859fc98ca1bafcf1
- SHA512 62a231635ed71cbfbd2171b877267743d91b0076dba33dfc82072bf2d12ceb580d12bc08f002db0009e1aa01b6f00f393e7757dfc949dc7e65b9d5102f05f03d
- SSDEEP 6291456:8ex7w2A2PslQPwCTCf8ME8WArppUPJ8jEbPIrz7cZQS7pF/159mP/kP:FTAhlhCM+CPQJbbmkZ/7pCk
- TLSH
  T16E09332DB147153FE98A82BFB875C404883B622675478D45BBE4D1ECDB4A070BE3E396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution installer persistence spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2