84fe27db6d00c4c666aaa37624bd35240e446f1630d908fa3e18637fc933b7dc

General

Target
CSVMusic-windows.zip
Size 399.2MB
Sample260805-2dr32sxfkb
SHA256 84fe27db6d00c4c666aaa37624bd35240e446f1630d908fa3e18637fc933b7dc
MD5 4e4a44ef622ef006aef85689e33b62f8
SHA1 979ff00be6434a188079cd830cffbe5372ab7039
SHA512 f7c3a4a685959066dbdc148f77ccef6b1a85b1dbf46c2956d68eb91029a279138f39dca1323169a01a274c3731509cffc8ebf54dcaab5d819ad1c5b41fc16437
SSDEEP 12582912:j2gIXLOFcBIZEBptbcj2olVmqXl7Poltvo+FYl/:jJIyJZEBphcV6qV72Q5/
TLSH
T1691933A044D2DD9C360AA6F3C0F8CDDBB64950DFE5435ECD298463597F873C2A928E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CSVMusic/CSVMusic.exe
- Size 383.9MB
- SHA256 540fa354f99e4514dea86b3520935a0d8b26b5b2df05bcec51f5162bc920af4e
- MD5 3c4f4334bbb860e03faad8c20930072f
- SHA1 07348f31ccef8818a3b8207322464682717455f2
- SHA512 18799a3be035fd307f92e28603f6d8651e6558cd3bf46f47a0aa361f18b2f8823407c30dfabf28abace77e641c62d5b804c369a34e8209d68a390bf6616d9dec
- SSDEEP 6291456:dXfW2UB6UujkR5hEhqLrKbY5Qmt18Vt7q+Oe/sCTNnpLKNwhnWOIlDFbSa9SnPT9:dXuSUujkpEhq3KbYRt478msChpDIBtSc
- TLSH
  T172193344AFD6C676F00767F3D0E9E896B1687858F70AAB8D2960511B3F432C2673CD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  app.pyc
- Size 6KB
- SHA256 a3248d2e64b75881bb7e1056059075f1b7f0b34e254986f3a832efed5886aa09
- MD5 13065821b6e8403ff8b266882ff58adb
- SHA1 bdc95b14530302267edbd8bc04afcddb006e9ef2
- SHA512 4b4c99b3373b96f3a8e132293db3f893a7d266b1327d41e87334c6d54f32af707134aa0f970e9565774bb227bea3b8e25e9150684015426493562813e214a6d3
- SSDEEP 96:UPsLPReIo/OA4fRuGnjG3gOGdE6IfEA1quYFE8iQ4JYYzz5xzI79T:UPsLPRa0RCmdcfb10FE8iQ4JYD9T
- TLSH
  T134E19481B613E97EFD75B3B6C416121A73F9ECF2F290DBAB26588406CE432212D201CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution persistence
behavioral2
- Target
  CSVMusic/yt-dlp.exe
- Size 17.4MB
- SHA256 52fe3c26dcf71fbdc85b528589020bb0b8e383155cfa81b64dd447bbe35e24b8
- MD5 fd06cf7b15df3b08e2815a28c30fe7f4
- SHA1 74d0a0332be4a9cc008a2ba04edbce4468b0aeaf
- SHA512 85c099c46d2afd583e95a49ba1d4c52372bbb641e36251abf455a6adc39230b68e9e90778aa19e5897799c7a2838e504812f98c3b19babd2f15eb8336155c56f
- SSDEEP 393216:0u/tSd5gzUL9gatuw8DfDgrc6paxiscCCDo3D3xY6336:bFS3maohb0IWaxuCC8z
- TLSH
  T1E907334EB5C1DCAAC8E6DCB5089BCA34E0B1FC11874AA95ECF6DBB931F875849513E40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3
- Target
  __main__.pyc
- Size 371B
- SHA256 ac232904a85558cbffadc3514d65fd19728ea013b489ec8352285a53d3daafec
- MD5 b7094c47f6abd2b68c259c0caaeb1355
- SHA1 ba14749e2cf0d23ad5356228022730c9dd4654e0
- SHA512 594dab5ee13795e0b5ec81f26040852032a8b02087c479c8fc58b339384879c00243dca7dd11e2c8d4a9640876c91938d85b5d62aa57534f02ef806fa23da0d3
- TLSH
  T1E5E02015553675CDF0F8A7F97430651044F6BDEA976510031709D553B4443202F5D70D
- MD5 SHA1 SHA512 TLSH
Score

6^/10

google execution persistence phishing
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
  phishing google
behavioral4