Hostile ^92% Download

6e89eb886aacc05038c7634eb1247405e8c59f203441f40f611605bec4d426b5

Stalkerware with location tracking

Tiny PE embeds a cleartext HTTP URLVB6 Run-key dropper stages an exe payload

SHA-2566e89eb886aacc05038c7634eb1247405e8c59f203441f40f611605bec4d426b5

MaleculeK₂(Li₂Te)O₇(C₃As₆DyEr₇IP₄Pr₂)H₈(Cm₇CrDb₁₄F₉MgOs₁₉Po₁₂U₄)Md₆(Bi₁₆BkPaPt₂Si₄)

Evidence

Entry point in non-standard section 0x3c0–0x4a0

⋯3 more rows
0x3f000000000000000000000000000000000................
0x4000a06737472696e670000000000000000..string........
0x41000000000000000003c10400000000000........<.@.....
0x4206d1140000400000000000000c4294000m.@..........)@.
0x430ac284000d42840001829400011000b00.(@..(@..)@.....
⋯7 more rows

USERPROFILE path environment variable 0x61a0–0x6260

⋯3 more rows
0x61d054454d5000000000ffffffff0b000000TEMP............
0x61e05553455250524f46494c45005356578bUSERPROFILE.SVW.
0x61f0f28bf88b07e8fac4ffff3bc60f9fc38b..........;.....
⋯7 more rows

References the LZMA SDK LzmaDec routine 0x7420–0x74e0

⋯3 more rows
0x7450145f5e5bc3000000ffffffff16000000._^[............
0x74604c7a6d614465636f6465206661696c65LzmaDecode faile
0x74706420282564290000c6400d00c6400c00d (%d)...@...@..
⋯7 more rows

Disable WoW64 filesystem redirection 0x850c–0x85ec

⋯3 more rows
0x853cc3e9ba9cffffebf05f5e5b595dc30000........_^[Y]...
0x854c576f77363444697361626c65576f7736Wow64DisableWow6
0x855c3446735265646972656374696f6e00004FsRedirection..
0x856c6b65726e656c33322e646c6c00000000kernel32.dll....
⋯8 more rows

Inno Setup self-extracting installer 0xa348–0xa428

⋯3 more rows
0xa37801000000030000000400000005000000................
0xa388496e6e6f205365747570205365747570Inno Setup Setup
0xa39820446174612028352e352e3629000000 Data (5.5.6)...
0xa3a800000000000000000000000000000000................
0xa3b800000000000000000000000000000000................
⋯7 more rows