General
- Target FL.Studio.v25.1.6.49971.exe
- Size 2.0MB
- Sample260708-vkd2facz7m
- SHA256 b7f1a5f1bccf693752cb34a8be6f90432827a4b40e335adf12ab1cc79fdbe400
- MD5 58de2a52852016e551894df7f1873379
- SHA1 d8617ab664a1f7461c911fa56b277e5db7f6ff72
- SHA512 1699c4169079a5c264d894a95e31f386fd458b2326e1e8372a192d881f7b9737dc6c2c923ff21eec9fdd1bea596ad1f39293fb3c96d6b9a9558665629a7c67fb
- SSDEEP 49152:Cug78TJIrHoO3XEpXeGxV71F5tD8R39s9moPMjzOH:y78dhO30pXeSVbrD8RNsnSzO
- TLSH T1A1A5331D22E8A0B6D17857B495F40A97A131BC82273487BF3BC65AAF27379C07532F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Malware Config
Extracted
Family
-
stealc
Botnet
-
veon
C2
-
http://160.20.109.67/32ded3c58047430d829e.php
Attributes
-
url_path
/32ded3c58047430d829e.php
rc4.traffic_key
rc4.plain
Targets
-
- Target FL.Studio.v25.1.6.49971.exe
- Size 2.0MB
- SHA256 b7f1a5f1bccf693752cb34a8be6f90432827a4b40e335adf12ab1cc79fdbe400
- MD5 58de2a52852016e551894df7f1873379
- SHA1 d8617ab664a1f7461c911fa56b277e5db7f6ff72
- SHA512 1699c4169079a5c264d894a95e31f386fd458b2326e1e8372a192d881f7b9737dc6c2c923ff21eec9fdd1bea596ad1f39293fb3c96d6b9a9558665629a7c67fb
- SSDEEP 49152:Cug78TJIrHoO3XEpXeGxV71F5tD8R39s9moPMjzOH:y78dhO30pXeSVbrD8RNsnSzO
- TLSH T1A1A5331D22E8A0B6D17857B495F40A97A131BC82273487BF3BC65AAF27379C07532F16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Suspicious use of SetThreadContext