Overview
overview
8Static
static
5Download More.url
windows11-21h2-x64
1FiX/MediaM...ne.exe
windows11-21h2-x64
3Join Teleg...re.url
windows11-21h2-x64
1Keygen-BTCR.rar
windows11-21h2-x64
1BTCR/keygen.exe
windows11-21h2-x64
5out.exe
windows11-21h2-x64
3btcr.nfo
windows11-21h2-x64
1file_id.diz
windows11-21h2-x64
3MediaMonke...13.exe
windows11-21h2-x64
8Analysis
- user interaction
yes - max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 01:45
Behavioral task
behavioral1
Sample
Download More.url
Resource
win11-20260130-en
Behavioral task
behavioral2
Sample
FiX/MediaMonkeyEngine.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Join Telegram for more.url
Resource
win11-20260130-en
Behavioral task
behavioral4
Sample
Keygen-BTCR.rar
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
BTCR/keygen.exe
Resource
win11-20260130-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
btcr.nfo
Resource
win11-20260130-en
Behavioral task
behavioral8
Sample
file_id.diz
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
MediaMonkey_2024.2.1.3213.exe
Resource
win11-20260130-en
General
- Target Keygen-BTCR.rar
- Size 4.6MB
- Sample260421-b6xk5aax21
- SHA256 052c931b1d6e4483b287bd8ec07e3535f54a7be1031565960130058ff380989d
- MD5 5ebf405ab954044eac0f2524b25fe031
- SHA1 a79d2d8f750cf63199eb8bef5f96f541f0267b51
- SHA512 224db4b5c4e9d8e1cf5fe2eae48ec44a916816796419b74edca194a1c0ab61bb0e8b3e2c70f2c7e6f71ccafda857de75268f32404f1edade521d04b0ba4136c0
- SSDEEP 98304:qMINW8p/5MEsNWUnDB++zmxyvL+Gs6856/dnLvhQM9s3lPjsBwox9rrJ6M:TIow/udnnsOiGs1qdtQ24PjMwM9UM
- TLSH T19C2623A1F342A0B7F169413DBA61845A0491AC33B0E8DD91B7DFA86F533BFA11C36D19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3160 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3160 7zFM.exe Token: 35 3160 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3160 7zFM.exe