7da9a9f95fe073f69ee4cd68d7c8283f07b1f08aca44ca9975f05c2f7923141b

Sharing

Copy URL Twitter E-mail

General

Target
FL Studio 24.2.1.4526.exe
Size 134.7MB
Sample260706-bx4cbag13t
SHA256 7da9a9f95fe073f69ee4cd68d7c8283f07b1f08aca44ca9975f05c2f7923141b
MD5 6a0753d8ce5efd789c78acca11dfbd65
SHA1 12a1e091c7a8007dffc34befd684a51d647834f7
SHA512 c20f05566b229cc970b8c65735d82fe700d41399cfc02885bf0de40ed8185b1e8c2d567f55a3fcf18765fccc4a8f84ed66747ba05ab863154b683b957912f425
SSDEEP 3145728:5bvtBrFEt30xaRIjBWdoJbGKkjY9f3riLf+xwbK/f/9vD:z1KtmjBWdoJbGPYFuLfi97
TLSH
T120683355A6B38474F928CB771328C592160639D8CEAAC8C71CCE001C1D5BAE75AF76EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FL Studio 24.2.1.4526.exe
- Size 134.7MB
- SHA256 7da9a9f95fe073f69ee4cd68d7c8283f07b1f08aca44ca9975f05c2f7923141b
- MD5 6a0753d8ce5efd789c78acca11dfbd65
- SHA1 12a1e091c7a8007dffc34befd684a51d647834f7
- SHA512 c20f05566b229cc970b8c65735d82fe700d41399cfc02885bf0de40ed8185b1e8c2d567f55a3fcf18765fccc4a8f84ed66747ba05ab863154b683b957912f425
- SSDEEP 3145728:5bvtBrFEt30xaRIjBWdoJbGKkjY9f3riLf+xwbK/f/9vD:z1KtmjBWdoJbGPYFuLfi97
- TLSH
  T120683355A6B38474F928CB771328C592160639D8CEAAC8C71CCE001C1D5BAE75AF76EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Handcrafted Metal Shirt.exe
- Size 212.5MB
- SHA256 c9928a195919839f0f5fd1a56adcd0618a3a2837374357116dcc4ff85c79971e
- MD5 cb0e7e42c52160d563af82201138f88a
- SHA1 2eeb1e3c49449d61bd5eb1afd82c5a74acb84b83
- SHA512 31cde39286212cb443749f05b93d91e0bca8fb4fc60f2f5623116be108cb333e88794cd7754091e3f4fc1c8f7de4e603e8e6ead5f7f889b78725ee548efab15b
- SSDEEP 1572864:EYOueq/jLLjV4Z1A3IddZPFR7oFoTBY1UIxCsGimyApMMPsTEVtccEAzdFkAEcBP:fjIoF4dJlzR
- TLSH
  T110B88B03E29A41D9C05DD1755B5AA233FEB1B8054B24B2DF2BA447522F76EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9
- Target
  LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
- MD5 68bebb0e4b93ed694e4493608a77f457
- SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
- SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
- TLSH
  T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral10 behavioral11
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 db72abfc0de76ff1504e240da07c1dfd8646ce46aa30df9bf4fb2258161f97d1
- MD5 f7bd36d4e0f7c477c05b96a054baf68a
- SHA1 d268b3fdb13073a986eb80238aac252bdfb076fe
- SHA512 5d72972a99ee5a72124acbc38b98e95467be7cd0266ea9c82e828d7b0f3b129bc6767f78e6e255678ae55987a8714ab9a46279bce618e4ddab5c86b85dc3781e
- SSDEEP 393216:zUTn+V5ObvlrOM6ONrkCoXAroHeOKxM6e:Teb4eCVwM6e
- TLSH
  T113473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 ced08d56da30dc9671c088870f8cd0820fb5b43d568be5588d9934b883cce43a
- MD5 8d3a594549fb95fa1e35d77b5d7e2c7f
- SHA1 b14278e2a2f0c8dc3bb42b3438c7693098ab93cf
- SHA512 786c908e13f7042a168022442fc49882ed3e9660849c4cac919bb2aab11a68cbe06b70423c125ff90bed626a9c1ef110a54f0bae0fd000f7ea388b2802aaf2d0
- SSDEEP 49152:7lGCNdPwp1E6o/xi59rx2yrT3199aWLKIb07k6hlVv4NoJHDDGgwvm:7lFirE//w9N2yrTaHwNoJus
- TLSH
  T132E59E02F6D651DDD019C03497AF9213F631340A4F209AEB16909A263F6BFE87D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 508KB
- SHA256 f158a8da0e8b6c56bcdac67ed95446df6f984ed192d895a5c8040a43e8343bef
- MD5 617e3f7f69a5c2ceaa6e18c6d7517039
- SHA1 ae1e2ed7d19551829770fdf4d452f7ce352d7fca
- SHA512 a81944fd41a9b645e7096fb880fa26fe696344739f8b640b0bfd17603e10233fb10324c6c42db53fcd072abf7c59a3ffe569256750298587901079f52d8f0b9d
- SSDEEP 12288:I162HbwE8+Tj5I9dWnQccIu+GwhugaD2:4221IKu+5OD2
- TLSH
  T1CCB48E15F3E94BACD07AC1348A438646DB7178921B65F9EF02E052352F3BBE45B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 c3e413e81f52f64415481daf16232e18ae19caa6b0cf2768a02a0a51d3436b60
- MD5 9dc8277561d6df78fdfc0d66aa71730c
- SHA1 52ddd9022f5ad044d254a433f80e0c18ae5e5952
- SHA512 9e2b4cf6938ca730c49e5e24ec113b6142d2b7f5127b0c1bc42cc95b8ab1020d5fcb5f262616a520c1507e7f9f2e387edfadd4a85c2fc04e1cc3e02b37ff0ff1
- SSDEEP 98304:sSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBG:FqQ74KDzTO5CGdBG
- TLSH
  T1A2867C03F68641D9C05DE2749B67A223FB34B8450724B7CF2AA457152F6AFE0AB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  locales/ur.pak
- Size 980KB
- SHA256 ba94f43cf5fa31982d1a559262dfc13d34ad028e2d23dc5a11813f1645842ae2
- MD5 1ebcabbd3c8a4cb3655d3db945affbd2
- SHA1 78221d3383dd3e9e3e07dea1e82e73c77329e0d6
- SHA512 a4fe33695a839625e17c2e8ea8e6e4e38e99089e5e162a0d21c1c5f2abe261490c6abc2897713eedd3c6431b2cac49c722655c13790087bfa03071ddda05911c
- SSDEEP 12288:69F8vQ6Kt5oMu8PC3zqtdQ+BR7yArubcvqmEhdGuOZedQYrGuYjwadcJKwUvuRcx:C8v1FGYW
- TLSH
  T1B52500D2E6B896B35A21D92780D33C34CB735F13D34AF285E92246C54E9A0135F6DE3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  locales/vi.pak
- Size 774KB
- SHA256 90ac2cd4502f502edf5b9cce089763df623a608849bc381efb3a3c20801341f4
- MD5 55f00640c09eef7614af067328633651
- SHA1 eefc3d5b3509e32bf7d939a8d8c74bf348b4a211
- SHA512 be8a517c2a4c54eb37716b90de106993f2a2d860ed54de12ea9141635138127cca8571af80665a57cee680e1e656c4ae02ca051c60c9acea9b54317dd8cd10ae
- SSDEEP 24576:IK+c0JV204Fvo/YE+tsjlIsicufpq1ljz:IbusiVk1ljz
- TLSH
  T11EF4855216E0302680AC553EC6CD540D6FCAE42FF7C1CFE56FE4297876221A46F25BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20 behavioral21
- Target
  locales/zh-CN.pak
- Size 554KB
- SHA256 da523b8e933ca98f571fe3ac398a53d362445410b3469288d43553d65d1bce3e
- MD5 820aa128a3f8e04ba5e1a3a91e5e0247
- SHA1 30d4aa4984bb42eda4fe32278679e25f062910ca
- SHA512 0d56cfed05038e15d302cafc1a2d26eea43d8edc9c3e8ea696ae02e269fe0ed8e43a4640c1282bc90a9747f9da58c1858c354b32b1e38be3b9b767ca3fb8c5bd
- SSDEEP 6144:2FPYjCp4EA2h4fE+gGinx7dpUJkKfQiJ+CLJfR6UUYfDM82ZsQnWgMVl+:UYjYwE+gxnzpUJkQQaRNUZYfDMzsDU
- TLSH
  T1E2C48CA820F9BDEC044650E13729613D7C40724BF667AF35AED248DD2AA1FAD0757E07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22 behavioral23
- Target
  locales/zh-TW.pak
- Size 547KB
- SHA256 2ac36905c94b7d4fba0b3cc3841f14dbf5ba08766eecdd787b45ea736d1e0dcb
- MD5 519b368f162172f2e5346be284d1e230
- SHA1 70a514a4672c3bd677f2a2f506ccb43b2235cc21
- SHA512 07618303fc85eca01ab83e7b8ba1518e97beae92baedd3f4140a7a30779ee3dd941befb6577c183f83768fdde9d31e10bda9387a4854631a9921234446cbaefd
- SSDEEP 6144:TOJ/fILE1HO0bNag/uPVJm4DIa2sluXdAr5rqo2HZD5SWWX2jXUmFTu:TORAI1Rui4UpdAr5mo2Hnjj4
- TLSH
  T1F8C46CB60CFBDBEF0901F484B7CD523ABC8B386DDD777636FC8918941E69A540AA1085
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24 behavioral25
- Target
  resources.pak
- Size 6.4MB
- SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
- MD5 225717135d7853f4f79372a197eb1a5f
- SHA1 aa8627b1e66fde80e812bef290aefa657643c487
- SHA512 0edaf8862f7e7350a602c0d5d20e84bd2e2a4f6dff88944357ddc82345aa226c8151fcdffcea468d0304f89be1b41fdb3424c871b8a3a5adbef447abf7839650
- SSDEEP 196608:4EVBRafszNQoCmkrB0QMguFBgt3m06Rw+Ki:4EVTaV9mkr4jFWBm0iw+h
- TLSH
  T1D06633DB72352C4FC54883FE4528417A786CA7A53D8591A2159C6228CC3E34F7EC9ABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26 behavioral27
- Target
  resources/app.asar
- Size 4.4MB
- SHA256 05ee075ba346d396e9370552e08181d26d256931443d1fda4575fc5d0c1780b2
- MD5 349425c5f0d61b8a55a47928c4bbed19
- SHA1 aae367403ae11ad27357f0f2aefeee41c8208773
- SHA512 a6b42a1f825c3b467a6e8e2b88d9f9992ced0ebea3b9a34c91cc984cb7b0b995e3c80e97832563e5dec5670f653101ae3ff3035d24fa722b47a9e1fa15646393
- SSDEEP 6144:bbZi6Nq+Pcl856HZEin9SaKk9MnvlhKYwk50DhOMxCET+/W+IRDKwXpt9jsktNnC:bbZPw1rnewt8KvIJDbYM/
- TLSH
  T1B826D3F793A94D3F88AF1A0ACD356E9C54B54C720A4EE04EF927B648C57C1835B84B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/addon.node
- Size 66.6MB
- SHA256 aca57fd81d1d71ef0b9bb81fed8c2ba4a844219e6a5143918c6226973ada0537
- MD5 d1bb671246ed5209b02ac4886998fb15
- SHA1 2bc80659388048c2e77a798b0ae15aea3065caad
- SHA512 c1178d4394d7f7aa18b0d652adbb57313f95db4b5f265ab671a8df9c6604b8d4496bdfe476d011a893ea5c72d7208377c16959905061fcf3b66f48ad50f40eee
- SSDEEP 1572864:3S2Jf8/75ZDcZB7vCbJnkPZJwvdnEDnc:3S2NGwZwJkBJwvdnEL
- TLSH
  T147E7F12BF6A400A6D06FC07986579607DBB2B4544B20D3DB32AC565DAF23BE55B3F320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral30 behavioral31
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32