Overview
overview
8Static
static
5Download More.url
windows11-21h2-x64
1FiX/MediaM...ne.exe
windows11-21h2-x64
3Join Teleg...re.url
windows11-21h2-x64
1Keygen-BTCR.rar
windows11-21h2-x64
1BTCR/keygen.exe
windows11-21h2-x64
5out.exe
windows11-21h2-x64
3btcr.nfo
windows11-21h2-x64
1file_id.diz
windows11-21h2-x64
3MediaMonke...13.exe
windows11-21h2-x64
8Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 01:45
Behavioral task
behavioral1
Sample
Download More.url
Resource
win11-20260130-en
Behavioral task
behavioral2
Sample
FiX/MediaMonkeyEngine.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Join Telegram for more.url
Resource
win11-20260130-en
Behavioral task
behavioral4
Sample
Keygen-BTCR.rar
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
BTCR/keygen.exe
Resource
win11-20260130-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
btcr.nfo
Resource
win11-20260130-en
Behavioral task
behavioral8
Sample
file_id.diz
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
MediaMonkey_2024.2.1.3213.exe
Resource
win11-20260130-en
General
- Target file_id.diz
- Size 720B
- Sample260421-b6xk5aax21
- SHA256 2a863f50c85dd90aa5259daaa202a0f703d84cda582d5577ab362af8137a97ed
- MD5 a55af84d6eebf080e13f241c6710e55e
- SHA1 6ad3401712afe2b7745ca046a20cde569b9b51d8
- SHA512 be703fc498b6c1b5365c4300452af5ae1f28ac4e08a2333b6536abd5d7abcff0dc4a0a0d7c1395f2bd1458aa61bff1e5d9fa41d62cd2b1f6f3c1ad6fae536390
- TLSH T1D301F9681CA0D7135D09F7F6075BF62DE2442411C709C6A3B76E2FD8AB42751260FC8B
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4140 OpenWith.exe