Benign windows Download

SpyShelter.SpyShelter

Legitimate security software installer

Native remote thread (RtlCreateUserThread)Installs and starts Windows service

SHA-256c0a41791da56b2fa837594e1be2762486ddf018bdc8506c62101ea9514662196

URLhttps://spyshelter.com/files/SpyShelterSetup.exe

MaleculeK(Li₂)O₇(As₃Er₄P₂CCaDy₃Pr₂)H₁₁(Po₁₈Cm₂₁Cr₁₃Db₇DsF₁₉Hf₃Mg₄Os₃₅TiU₈)Md₇(Bi₁₁Bk₂HePa₂Pt₃Si₄)

Evidence

NSIS self-extracting installer 0x25c4–0x2694

⋯3 more rows
0x25f42f00008b45d8a9f0ffffff757c817ddc/...E......u|.}.
0x2604efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x26147de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x2624580945088b45088b0df08e410083e002X.E..E.....A....
⋯7 more rows

Modify service configuration sps_service.exe · 0x302fa0–0x303290

⋯5 more rows
0x302ff02205931902000000c015390001000000".........9.....
0x303000d015390001000000f8153900b0ffffff..9.......9.....
0x30301000000000050000000000000000000000................
0x30302022059319060000002c16390001000000".......,.9.....
0x3030305c163900070000009016390090ffffff\.9.......9.....
0x30304000000000010000000000000000000000................
0x30305022059319060000002c16390001000000".......,.9.....
0x303060f4163900070000002017390090ffffff..9..... .9.....
0x30307000000000010000000000000000000000................
0x30308022059319060000002c16390001000000".......,.9.....
0x3030908417390007000000b017390090ffffff..9.......9.....
0x3030a000000000010000000000000000000000................
0x3030b022059319060000002c16390001000000".......,.9.....
0x3030c014183900070000004018390090ffffff[email protected].....
0x3030d000000000010000000000000000000000................
0x3030e022059319060000002c16390001000000".......,.9.....
0x3030f0a418390007000000d018390090ffffff..9.......9.....
0x30310000000000010000000000000000000000................
0x30311022059319040000003019390001000000".......0.9.....
0x303120501939000500000080193900a8ffffffP.9.......9.....
0x30313000000000010000000000000000000000................
0x30314022059319010000001815390000000000".........9.....
0x3031500000000001000000d0193900e0ffffff..........9.....
0x30316000000000050000000000000000000000................
0x3031702205931904000000f019390000000000".........9.....
0x3031800000000003000000101a3900a8ffffff..........9.....
0x30319000000000010000000000000000000000................
0x3031a022059319010000001815390000000000".........9.....
0x3031b00000000001000000a81a3900e0ffffff..........9.....
0x3031c000000000050000000000000000000000................
0x3031d02205931902000000c01a390000000000".........9.....
0x3031e00000000001000000d01a3900e0ffffff..........9.....
0x3031f000000000010000000000000000000000................
0x30320022059319000000000000000000000000"...............
0x3032100000000001000000f01a3900e0ffffff..........9.....
0x30322000000000050000000000000000000000................
0x3032302205931904000000141b390000000000".........9.....
0x3032400000000008000000401b3900e0feffff[email protected].....
0x30325000000000010000000000000000000000................
0x3032602205931901000000c01b390000000000".........9.....
⋯3 more rows

Native remote thread (RtlCreateUserThread) sps_service.exe · 0x303e80–0x304130

⋯3 more rows
0x303eb04553534147455f51554552595f46494cESSAGE_QUERY_FIL
0x303ec045200000000000004b65792f76616c75E ......Key/valu
0x303ed06520696e666f2073697a652069732077e info size is w
0x303ee0726f6e6720666f72204d455353414745rong for MESSAGE
0x303ef05f51554552595f46494c452000000000_QUERY_FILE ....
0x303f0020754d7367547970653d000000000000 uMsgType=......
0x303f10556e6b6e6f776e205365727665724861Unknown ServerHa
0x303f206e646c65526571756573743a20000000ndleRequest: ...
0x303f30985f384001000000a071024001000000[email protected].@....
0x303f40b8790240010000004073024001000000.y.@....@s.@....
0x303f50e8920240010000002090024001000000...@.... ..@....
0x303f60608d0240010000008894024001000000`..@.......@....
⋯8 more rows
0x303ff065450000705000002e00000000000000eE..pP..........
0x304000696e76616c696420737472696e672070invalid string p
0x3040106f736974696f6e0064657175653c543eosition.deque<T>
0x30402020746f6f206c6f6e6700000000000000 too long.......
0x30403022059319070000001828390000000000"........(9.....
0x30404000000000070000005028390068ffffff........P(9.h...
0x30405000000000010000000000000000000000................
0x30406022059319000000000000000000000000"...............
0x3040700000000001000000a0283900e0ffffff.........(9.....
0x30408000000000050000000000000000000000................
0x3040902205931902000000c028390000000000"........(9.....
0x3040a00000000005000000d0283900a0ffffff.........(9.....
0x3040b000000000010000000000000000000000................
0x3040c0220593194b0000002c29390000000000"...K...,)9.....
⋯7 more rows

svchost.exe target path sps_service.exe · 0x320318–0x320488

⋯5 more rows
0x32036860a83a00b0ffffff0000000001000000`.:.............
0x320378530079007300740065006d0033003200S.y.s.t.e.m.3.2.
0x3203885c0073007600630068006f0073007400\.s.v.c.h.o.s.t.
0x3203982e006500780065000000000000000000..e.x.e.........
⋯15 more rows

Resolve exports with GetProcAddress sps.exe · 0x386610–0x3867f0

0x3866105b000000600000007b0000007e000000[...`...{...~...
0x3866203000000039000000410000005a0000000...9...A...Z...
0x3866305f0000005f000000610000007a000000_..._...a...z...
0x386640ab0018206d1f1b201c2001001f203920... m.. . ... 9 
0x3866501a00022e042e0200092e0c2e03001c2e................
0x386660202e0400000000000000000000000000 ...............
0x38667000000000000000000000000000000000................
0x3866802000a000800080160020800901200a20 ........ ... . 
0x38669001002820292001002f205f2030000030..( ) ../ _ 0..0
⋯4 more rows
0x3866e001000000000000000000000000000000................
0x3866f000000000000000000000000000000000................
0x386700001701001a170100010000001d170100................
0x3867102b170100010000003017010046170100+.......0...F...
0x38672001000000000000000000000000000000................
0x38673000000000000000000000000000000000................
0x386740001001004d1001000100000052100100....M.......R...
0x38675075100100010000007f1001007f100100u...............
0x38676001000000000000000000000000000000................
0x38677000000000000000000000000000000000................
0x386780400101008e01010001000000a0010100@...............
0x38679000d2010060d0000001d2010045d20100....`.......E...
⋯6 more rows

Go build info marker string sps.exe · 0x5e77f8–0x5e78b8

⋯3 more rows
0x5e7828756e74696d652e697461626c696e6b00untime.itablink.
0x5e7838676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x5e78486275696c64696e666f2e726566007275buildinfo.ref.ru
⋯7 more rows

Showing the top 5 files — 10 more files (209 regions) not shown.