6ad50d55109f21db17797b6cc25e758dc9dc068ebce4de12affa11ad30db4b23

Sharing

Copy URL Twitter E-mail

General

Target
fl_studio_2025_pro1.exe
Size 89.9MB
Sample260626-1ctptafw6m
SHA256 6ad50d55109f21db17797b6cc25e758dc9dc068ebce4de12affa11ad30db4b23
MD5 0d67045cc4a73d5e51047fd4ea3eebc6
SHA1 68296a9c77f1c8ab78f739689df11bd3e2357562
SHA512 f9b9a101d8bca40e88a670cad310e40580f779d73d485c4e1b2c7981a5ece451b1e2edbc0fe98b191a8d4d9f8856a84bb66cd36641429daecbc279880e79c6bc
SSDEEP 1572864:PqhqgOwXqMksvoBAP9P3m/0zrSFdyKJ/U+eJZfxEnJSSBz1B+KZ5ZKlKQfG+50OF:ShqgO4qMksuAPRzr4yKe+s9x2PBz1QEO
TLSH
T14A2833609AF7434FC6174ABD4256F3B589D2DEC196980BC24478C3B0BCF8A9B91531EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fl_studio_2025_pro1.exe
- Size 89.9MB
- SHA256 6ad50d55109f21db17797b6cc25e758dc9dc068ebce4de12affa11ad30db4b23
- MD5 0d67045cc4a73d5e51047fd4ea3eebc6
- SHA1 68296a9c77f1c8ab78f739689df11bd3e2357562
- SHA512 f9b9a101d8bca40e88a670cad310e40580f779d73d485c4e1b2c7981a5ece451b1e2edbc0fe98b191a8d4d9f8856a84bb66cd36641429daecbc279880e79c6bc
- SSDEEP 1572864:PqhqgOwXqMksvoBAP9P3m/0zrSFdyKJ/U+eJZfxEnJSSBz1B+KZ5ZKlKQfG+50OF:ShqgO4qMksuAPRzr4yKe+s9x2PBz1QEO
- TLSH
  T14A2833609AF7434FC6174ABD4256F3B589D2DEC196980BC24478C3B0BCF8A9B91531EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 34e36e7d0888e8c9653314d375297abf3f027dc179920102b9b8293f79555de4
- MD5 f3036e9973dfbf9ba882aeddde0c1f68
- SHA1 ce6146a6b210ca7935a2c18aafe5b091581f4d9d
- SHA512 621a3fc71944cd6badb50bb88e30e0495d4f2570482c4a089bab2561660f88a1df4a7ba3ce0129d8dc71f439c9320203c7c13b771e59459dccb19dbcf5a4268d
- SSDEEP 196608:ZKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5emO0r:Z5G+lkvb3nV1GYIP+H1gQoV1Ioul3el
- TLSH
  T105473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 93f4c1a211c90978c585815ec652525d749e86ad6b6202c905ac47a85e4f66a1
- MD5 5d0ef421234712d67d4cfe0f9d6aae78
- SHA1 ca08540230e1d4abb8cf99ac2242d020d22f5c90
- SHA512 24f6c76225ceadfa01de89e8c784b58086f399a6a8c2d0ce9f271e6c11402e17849d2e79311661794d4859383fa4a4e88ab3b0ff256a01b4c3db604a4f949a26
- SSDEEP 49152:bv3nwJt5w3heAaTPLO6lNU81IQbx6i1N2fgPvA7lPUaLu2JiaoosxpSS:by5yfa3O6l5PaLu2hoU
- TLSH
  T1C0E59E03F6D251EDD029C03497ABA213F271780A4F205AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 467KB
- SHA256 630401e4e008b80c4bfca28cf01b02e371698e855aa132a7a31f6248c0a5c32f
- MD5 04f48321f798b648d2012d05df785c41
- SHA1 b4a8c3cb50fe663dbf74a0ba0160339f2d54b5aa
- SHA512 94c06b38f48d90d025fe2dcc670ccec4eec38fbf58dbdd8f4dfc1d2c77761d812d560d7e720c93160ab2b837a5191707ffd79bb556d490365565dfa750644983
- SSDEEP 12288:66/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:66/vCrovjLA94Mm
- TLSH
  T1C9A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 e9c1b0055ddd591fd33fa9a30a9adb262490f998b3c343b8225e14996aecbf77
- MD5 b60f635dbbdaa84199fb6e00131686c9
- SHA1 1f2e0f81d00f1e5cd9059130dbccb0feb966ffe7
- SHA512 3f7b105d93bcdab0243bdc36a17709944ab1af1f0fce3a1f14dbdc367e458891183ef5cd4bfebdd5e64279a0746f594ed02fb9f67c633a5b7fa44c67f095867f
- SSDEEP 98304:q28+0qrgWEefZGd0Txn5XUTMSEyGEEEE:u+0qcYfLctr
- TLSH
  T1D3866B03F69681D9C05DD278876BA223FA30B8550724B6CF2AA457152F6AFF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/index.js
- Size 206B
- SHA256 632ab5a01dfc1b519b06275f490d6790100a2f8d71d8f56957091d0fcc5b3e0b
- MD5 88844ba820e6db161e8595e2caa32276
- SHA1 f69dcd792f924e9d1d7bd50d6869c90411f371db
- SHA512 8f6897293dbeaa18867fd5adc0e19fa160a8967ab603a804c84cb5e9658e51df78f91eaa69dc3bff45bbe5cb652e12bd0097985edc34e69e192130662da71f29
- TLSH
  T1A7D0C76E1BFE6161430824544ABB53C5A8D6C8938A584A4251CC4D521D5471056951B2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/win32_x64/koffi.node
- Size 1.0MB
- SHA256 5390a6e75d1276cb87b8827303c4e8fc3ed9a6e012bf3c43c6c28bd6bf308d51
- MD5 c652c622c7bc15abeaaa3920abf3ed07
- SHA1 92d46a4ee65a21d613a1f50840740da74708bcb6
- SHA512 3726daef77b8032089f6e57a9c097a8219b60a244d5275ed2fc5a530fe0f5a28b57328d76dc2fb958ac6f593813175fda912fd034f11ebe1c32211a5684afd46
- SSDEEP 12288:IOHcorsvRUzgHBpfmrytFNXrfKh4O1nNJhdb/IMUs2Jb71WDecUq1v:IOHcorsvRUz8OOt3rKiO1nNJ72J6ecJ
- TLSH
  T1EE25E442F71A96E8C55DC0344B7BC3113921F84A077DA9D7D69CFE983E12ABC163A2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/callbacks.md
- Size 8KB
- SHA256 91a0067ed5e9558b8ad0ac34d75f0e76ada778c1b9d9176c8d77ba1f05ce84e5
- MD5 167c90e63c199a0802389c12fa9e7c9e
- SHA1 d35c59e17ae20394899ea4093d2e23e40f4a9790
- SHA512 5cd9b66792279223d0c3144880fb3d1bc1bcb45cb36ce87a372bd1106d80fad08c322e14dd474cdbec6dd6b78c629e253d75a0e45720c17230374a96dcdd7aa1
- SSDEEP 192:nRo/47oMLVLiahoHrG95jSrKyna41jrqDQsGxvqjWlSSl8RFCDiITQf51Fbep:uAk/koLsNilYBm
- TLSH
  T1CC02950B631353625CB1B3A3554F67B5A33FC8A9392982C0A48D93A53F5646D9333EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/functions.md
- Size 9KB
- SHA256 c266459abdd49c4727aa9309d651cf548d0aadb38a6d9c36ead3f41685de62ca
- MD5 22f82c7dbd9a13f5e3ec45d0daa259a7
- SHA1 ed2e6924394ec299782cef3efdcda0abc79deb95
- SHA512 da389d1d01d9ebbcb05c1ef7cded3709759324b1c566ad2b437c4b81f39e04d930cac7d3bde99c3d63479813af773d31844c273321dc6b6e330be7dd734ada04
- SSDEEP 192:IjTZRkLD2uonwty1T7Vlo/0UI+09qrmQSDyDNFbzSnUITVrwKozIbLNtjEz:0ZR1wtYn/oF0kCtCNFq51wBEHNtjEz
- TLSH
  T1D812B7063F42A3A5E1F3B2B1B20F65BEE23EC86531325081749D47A42F2A49E517FD9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/input.md
- Size 19KB
- SHA256 e4bd460c1821bb2156a4f5c952f7ed52294ca089c25e3d3acb627a4c9b9b8245
- MD5 e245280b66bc8c175863a90cd83f3832
- SHA1 aa1324cc329545db6bca9a6217c2219beae72094
- SHA512 85a84f1883aa48e8d85e3ca5e93b377f5e3ce0faad501d8e11d1c186809e14354950ce9d4ddb7eec4fdd1ab161dcd4c5fd9430d2387b547a76893b4f81e758ec
- SSDEEP 384:V1+vFwVFzgr5Wna9C/DwYE+gd3cDqEUEiL2pMy8bLX+6fG:H+vykr5Wn4C/EkIspUEZ58XXbO
- TLSH
  T14B92B6472EA1D234447282A3A34FA0A2FA24446F33E95AD4345E65383F079ADD3BD7DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/migration.md
- Size 8KB
- SHA256 06e3e4283857f5c711b057933808eb8121cfaae88976dd045e291aca5dd162b9
- MD5 686dde0cdbf231ea2c63c6bdf548b43f
- SHA1 cf453ad17051c5d122437f1857aed953ce8e05f4
- SHA512 0d04e709180df1d7ffb7a2ca1adafe2875406c32d5d1bafe2e09d7794926ec60075564a9b9a6232fb1636f8d231294e3c2fd0a5e82b02461c6847e25533cf037
- SSDEEP 192:IVhYG/QfckQxSPNTK6TMTWu/gLVLipkEeq7l98aAsf:dGkeV/rV8Mf
- TLSH
  T1B912B7136A67D334ECF16682B0435879633FCA9E325D8388780853B97F608DD17B976A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/misc.md
- Size 6KB
- SHA256 6f58028c7093137b8a08dc321d227efd6a0a0bf2707f5ab00fa58f5d88616bcf
- MD5 4e20cb6ae7bfb39b1532cf5aaa10afde
- SHA1 b61ded49e08ee6ea73570740a534ed8141f1711c
- SHA512 79ae813910770f1c342e2348ba3cda5ee6c2202ea4a3f514996041bc36ac83eb8286c541b24666a9a8dcb13847d3d331722ce6439a51cfd0050b513959d34944
- SSDEEP 192:+XLY5NFPq3QKtvS814zadxQ2E+PS+drDT1dsky6VSx:d5NFqnVxHn8krAx
- TLSH
  T1D5D1B8477F68C3151871E3A5F24EA0B5C339C49B33306ED674AC817C27148AA527E7AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/output.md
- Size 9KB
- SHA256 33bed142d40c9a7f896a9e7c63196408763cba22fa9ed17f62e1f5f37523fce5
- MD5 a6b0897fa319e403bf08768ab951d424
- SHA1 571396c7256e7264b741eda7f83a559db0facb3a
- SHA512 5b450a9cf991aef8990bb8b4cff25bfdc9ebd58a51a014c77446d838cff0555eec3af03fb9296cb8be0bc298eaeaedd7eb92f7ffbf90a4872d55ba8ef0461e3b
- SSDEEP 192:fPAmTLnanz3E8D0CO/sq17pGPKM3A65rEPxOsTw28y:fImvnanrjDOkq19IWTIy
- TLSH
  T18A12A72317657170646232F1A54FA9F9122AC44631654D807CAD47703FD38BEE2BABFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/koffi/doc/pointers.md
- Size 12KB
- SHA256 75750b08ce35835a83290cd2fe3b3476a20aef00dbbb1a9ec2ac7a178a46b8a7
- MD5 4752ede7ec892bbc50b4f94e4c3ac719
- SHA1 167b9da28fae9675e5e43dec355fd54a316de424
- SHA512 deabdf5f7277d70616b4cc7280e87176c1e58426b8a11691011874240f5a5e1563a1851e5427ba397179f0d46e4490816099a1aa9857bda016190028242e30d8
- SSDEEP 192:V6oVG/Q3RDF3xl29u8I4ja4EmDxR+tbNgI4qYkztgd1E/t8P+n5CQSY7Q6ns9icG:/VoQL3TQXDjrl7OlxkQSYncjR6TZ
- TLSH
  T1934298172752622094B213E2924E60AB9237D05633629ED138DD82783F97CBD61B6BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Maps connected drives based on registry

Enumerates processes with tasklist

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32