Overview
overview
8Static
static
1Cleaner--main.rar
windows10-2004-x64
8Cleaner--main.rar
windows11-ltsc_2024-x64
1GameCleaner.ps1
windows10-2004-x64
3GameCleaner.ps1
windows11-ltsc_2024-x64
3Launch.bat
windows10-2004-x64
8Launch.bat
windows11-ltsc_2024-x64
8killer.bat
windows10-2004-x64
3killer.bat
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
Cleaner--main.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Cleaner--main.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
GameCleaner.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
GameCleaner.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Launch.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Launch.bat
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
killer.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
killer.bat
Resource
win11ltsc2024-20260710-en
General
- Target Cleaner--main.rar
- Size 3KB
- Sample260721-3c151aar3y
- SHA256 0deb2aea78fa3b5ea9a31144691650d5f7f2bc66656d82edac765f18963a9c2b
- MD5 2601afc025dc071e3668352a6eaa6472
- SHA1 0997e59ded7e56620f52aa765d8a94b308cb0553
- SHA512 e8d0d1202eaf0a175e2e87ca23ab2f188f8263055c5893ffe7d90c6da906327b46e8f3c352906bae3904d9263854066512b463b16f9d3de1b4604702d653bde6
- TLSH T17D513C79C66AAB493AE7760540D35DBE1CCD200705C19BDB45E405D2258E0B5F4F2BC5
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4216 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4216 7zFM.exe Token: 35 4216 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4216 7zFM.exe