Tool-labelled executable delivered a distinct Setup payload
A sandbox recorded an OpenBullet-labelled program launching two temporary-directory Setup processes. The dropped file’s hash links it to separate analyses showing script execution, an Explorer-named payload and registry commands configured to run at logon.
A program recorded as Open Bullet.exe launched two processes named Setup.exe from a temporary directory. The filename alone could describe an ordinary installer helper. But the sandbox also recorded the dropped file’s hash, linking it to a separately analyzed executable whose reports contain script execution, an Explorer-named payload and registry settings intended to run commands at logon. What was the tool-labelled program actually delivering?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read