23eb35a348bbeecb81266f7206c697ab020e532375a4472cb7b8c48dd4e0ecd9

Sharing

Copy URL Twitter E-mail

General

Target
keepmusic-one.exe
Size 6.4MB
Sample260807-q1ewfseq4x
SHA256 23eb35a348bbeecb81266f7206c697ab020e532375a4472cb7b8c48dd4e0ecd9
MD5 bac3fac4c1a3ccbb0250ad17f65de813
SHA1 f27f7eff18728ce87e18739d649669fe5cc0a79f
SHA512 993c0f2a4f8dc2fb00c5b43e2a73fa6ffd44c47595a715bb0db7b4888b1ad24c8fc3f995b6ef5c5c561a99c853b2a79a58ad4c07451f1c2002d4010693b854d1
SSDEEP 196608:Jvnmv10HQMIdF1kml6GZ6j6CQrzf4j0oqSzR48EnKq:JvvQRd4mjZ6Rgf4j0ZSl48EKq
TLSH
T1CD663397CCAF4CE7CDC62C7DE172873A9983BE2585EA148E5A86FD241435AC314D7123
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  keepmusic-one.exe
- Size 6.4MB
- SHA256 23eb35a348bbeecb81266f7206c697ab020e532375a4472cb7b8c48dd4e0ecd9
- MD5 bac3fac4c1a3ccbb0250ad17f65de813
- SHA1 f27f7eff18728ce87e18739d649669fe5cc0a79f
- SHA512 993c0f2a4f8dc2fb00c5b43e2a73fa6ffd44c47595a715bb0db7b4888b1ad24c8fc3f995b6ef5c5c561a99c853b2a79a58ad4c07451f1c2002d4010693b854d1
- SSDEEP 196608:Jvnmv10HQMIdF1kml6GZ6j6CQrzf4j0oqSzR48EnKq:JvvQRd4mjZ6Rgf4j0ZSl48EKq
- TLSH
  T1CD663397CCAF4CE7CDC62C7DE172873A9983BE2585EA148E5A86FD241435AC314D7123
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/KeepMusic Installer.exe
- Size 10.5MB
- SHA256 23a7f2291b3dd4eaea95d0186135be3251b4f2ee8470d65307945f7e33514d08
- MD5 1bdb5dee48c3c04d222468603c663438
- SHA1 710e6bc47b25bfaee702cf3253f13837787fb289
- SHA512 b69c1b4abb2456d10bb411812b6f4992c64acbeaff4a7dc18bd71a64b6e282d8816757ea8dac33f9bdc83c349f5ecb8558607aa1a5cecb87c315e9068dc44e99
- SSDEEP 196608:AzCegSj9IYG2fUwctaJ0VN8R25/C53dc0nlDyVN:AzCeXj9VNf/c8J0Vp56E0AN
- TLSH
  T1ECB68E03B712D0FBC98742B0E02E97389EB3595853158DE3C694ADB899B93D12D37B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/api-ms-win-core-synch-l1-2-0.dll
- Size 18KB
- SHA256 664db8c5af73e50808862eeec1b0416a48c60864d680dbfe984f2384d09380a4
- MD5 80891c6dbdc40554cbc93c8b8b2c5e77
- SHA1 8edaad8d72d6fed680551e6aba2b0de059b8445d
- SHA512 4bb82e71785cd377fefebd4e8a828aedacbbf1688c91597fde97307742473b87b11139bd5819ad4c51d1acf0e0bcf616b38fcd1a071db5b9f82993c134e90a84
- SSDEEP 384:CtZ3UW1hWY5YHNfPfLeEdtpBjRYlmf37T4qlkOu:MhYBbeElfYlm3G
- TLSH
  T16E820787CBBC9103FD96AD7063E5D9837C3D97D36E50845620AAE2982DD33D0DB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/api-ms-win-crt-convert-l1-1-0.dll
- Size 21KB
- SHA256 2bce65e9c8c724c4874d2499dd12db85c290508ea02835f0118916442b74b34a
- MD5 2338fb44e898cc9993a063689e212c24
- SHA1 b46cce6ece0ffa5b42dfac100b189eb784b09f59
- SHA512 94fa4e669a57ab0156e35ec40bd9c64148776d76a72f7f8ba9b3919006d13ad7c29325a9e1da15b14610da51805b53527a8b1917c42ac271edd0126ba06fb681
- SSDEEP 384:GuyhW1hWh8nw0YHNfPfLeEdtpBjdYFhyf3i8pUcl3Cng:7ZbYBbeElrYDyK8pUk
- TLSH
  T1DBA2D8439AEC6B16E9DB2B7122F9DBC36E395783195042B48117E49C38837C1BE67C1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  $PLUGINSDIR/api-ms-win-crt-heap-l1-1-0.dll
- Size 18KB
- SHA256 4ac8f0aeb61d87847f440182814dd44632e1be3c11798c7b8f952380435a4f6c
- MD5 7d8d480c370ca584a317095c7151197b
- SHA1 07b9f70601f584a6d7d97d51f9202245f85a641b
- SHA512 b25019de6a35019f00bf9d9767f12c87efea625ebb1d9ccd11b435afc25dd676b38db879165524ee2fd064df90791c5d89ff6900c2d7d6682ce0ad845966b706
- SSDEEP 384:rY3eBW1hWpPYHNfPfLeEdtpBjdYPmf3aGSIle97YL:/QoYBbeElrYPmSG6p0
- TLSH
  T1C6823887CEBCA543F9D72E7063E8D9837D3E97C76D418126406AE1A829C33D0AB2552C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $PLUGINSDIR/api-ms-win-crt-locale-l1-1-0.dll
- Size 18KB
- SHA256 8f5ee5bd8d46952075a04e3ee09b3da2f5d324fce433d5489f06b4ce4d4f872c
- MD5 62562f65937a39c28b795e1acbbda9ce
- SHA1 2fb1ddd0fc9e8d1bc367a3c73f79723044f310c6
- SHA512 d330c6a502b8df39c8cdab4ac2ebdf672da0581cff6c20668747d89fabeb7c045dfb2f7b1bd12f74c1c8528e718362aee1e168bdbacad758e574c75364fc276e
- SSDEEP 384:GW1hWD5YHNfPfLeEdtpBjdY3FY+f35XhlMl:9MYBbeElrY3FBi
- TLSH
  T1B5821A82CBBC9143FAD76EB052B8EE837D3D67C36901955A106EF5982CC33D8AB1452C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $PLUGINSDIR/api-ms-win-crt-math-l1-1-0.dll
- Size 28KB
- SHA256 51b6fce544c7a61e4ef49137d10256cda690007da3a7b79526dc8772c96df6f8
- MD5 db8eb373d11c14e7698acbb77e316578
- SHA1 2ce8888d8c968602934d5cd16409758ea4a81fb4
- SHA512 bb52e10bb62462b2962cc950c1ea1960af10a220312f914bffe84b1cc705753d524df2ef531ad1d60bb837b1187fd43efd582cc6b031ccfccdd9a03d6d83d781
- SSDEEP 384:NOTEmbM4Oe5grykfIgTmLmW1hWQ1YHNfPfLeEdtpBjRYJf3dUdlaK:DEMq5grxfIndVYBbeElfYJuf
- TLSH
  T1BDD2C74789ECFF53E9CB1FB301F4CBCA6A381BA265D1A5B5D89B918434927C03E47909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $PLUGINSDIR/api-ms-win-crt-runtime-l1-1-0.dll
- Size 22KB
- SHA256 66e4de483adf7af252d67e0c988a163cfa76436485dce3badfd6740766b39432
- MD5 fe1e9c1f7975dd6751f7d66305ce995e
- SHA1 0a7150943eb973278b97db0210eea2cdbc474318
- SHA512 06c034f8d7e2ba029a06fabfb98e742cfe7bbaeb9da56b5bf4030185597ee4a1439b1c6081b0e1c5814a0b2be464750b76f4e7e4cdfec36ae746bbc11a3967e8
- SSDEEP 384:ub7hrKkW1hW2gYHNfPfLeEdtpBjxYpMf3Nzol9PXx:ubNrKnqYBbeElPYpMy
- TLSH
  T1F0A209878BFC6F13E9872F7212F9DBC76E3A53832940817A9457E09839C37D4BA16119
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  $PLUGINSDIR/api-ms-win-crt-stdio-l1-1-0.dll
- Size 23KB
- SHA256 cae1208c3bded797336dba2fca5dad3923b99d026e850c802327ce5555e35775
- MD5 b460c0a6b145fb30002fc6e1f70a4f7c
- SHA1 8ace170b9709e2d7854e4a5385bf05886b16ee26
- SHA512 7419bf32dcc66b44671d024f226d92d2e3f7b53829ce9fe25c6a3b9fda35831557650d0e87385b54c84f6fe762f142518984050b9377110bd59a2aaafa3e5f97
- SSDEEP 384:NZpFVhHW1hWGq8nw0YHNfPfLeEdtpBjdYNi6Cf3Kd8pUcl3CbFe:lo5bYBbeElrYs6Co8pUfFe
- TLSH
  T15CB2F88389EC7E03E6CB5B7226F9EFD76A3553C32804A1798017E49839C63D8BE03519
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  $PLUGINSDIR/api-ms-win-crt-string-l1-1-0.dll
- Size 23KB
- SHA256 8462cac692d42111aafb52b6eb6740987490e941407ea3921edc3c7306720b12
- MD5 b144912affaf4df8ae8a84f5ae2bd722
- SHA1 23c5a832433da19dff2c3eb4e5ac03f3492a289a
- SHA512 96199647d27ca4b165ded0edfed8feede79e63a01bc0a51140a4b67918ef1c2322321a92afdcad3ed39b634d2f16c04f41a894cfced92c069b0662feb619c0cf
- SSDEEP 384:ciFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWw5qYHNfPfLeEdtpBjdYvopf3b5:c6S5yguNvZ5VQgx3SbwA71IkFhLUYBbh
- TLSH
  T189B2C7434AF87F42D9CF1BB256F9CBC76E384F8629405275D067E48838827E5BE67908
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 29KB
- SHA256 c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333
- MD5 8def0196223484f8aed4106148dd3f08
- SHA1 e0fc0951deb0e5e741df10328f95c7d6678ad3aa
- SHA512 9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7
- SSDEEP 768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q
- TLSH
  T11FD23A18FCC97EBAC7DF05B119088D6E529FC8180754CEABE3B25E52D5A23322ED514E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 22484fdf3008a593e7ca188863d423b8b2a345391120ed296ce8b156cfa983ab
- MD5 2aeb55b75f68b4ea3f949cae0ceba066
- SHA1 daf6fe3b0cb87b4e0ad28d650fc9a190ad192b1c
- SHA512 3b6a6d6c87b8d9ab06fac72fa38067df4c7d4385d37d391d7ad58a623215681fc0366621ce3ce5c08af25e11cc468b18844ea5f7c8ccb71473c956c29d20188c
- SSDEEP 49152:RiEh3Ltyq6V5C+CiVDraE44S48VnGJzJJuG9OqM4mogAb:RiOyqkC+3al48VnGTJ/9OL4Fb
- TLSH
  T1A575222072E08131E6F71A309AF497B10EBDBD724A79A9EF53841F0D1A74AE1D235727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation adware defense_evasion ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral18 behavioral19