Muse_Hub[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Muse_Hub.exe
Size 40.4MB
Sample260807-s33fmsgl3w
SHA256 d4ec91fe557a62761b44041bdc80b8ce6a03562673f6a8e59435a6dd19c62c72
MD5 969dbe416e4927fb326c1702dd5ff237
SHA1 762ad6de832040e2ca5fa1a47df40eed31ad6fba
SHA512 8f0d21a9e37ebc9cbb743f5b554be2fbc47fc5f194ea68709fb2dfd6ece87b245919bf7d4894c5fa836aaf6434c559ece8fa7ba054e27c9836b3af1061fcc747
SSDEEP 786432:IBI5aBnCfe+qRcIuaArPiSWwEn0GidYne5LMMm1aTiOti+p3gBn67:IBwSYZqRcIXkaSWw/PbLS1aTiOXlgBno
TLSH
T13997331597F4D269D03BC37844B70222FAB270462BB09ACF1B69947E5E377E08677B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Muse_Hub.exe

.exe 40.4MB

Muse_Hub.exe

IMPHASH 6caa2d9e4ce234ccc8738b52994e7888
SHA256 d4ec91fe557a62761b44041bdc80b8ce6a03562673f6a8e59435a6dd19c62c72
MD5 969dbe416e4927fb326c1702dd5ff237
SHA1 762ad6de832040e2ca5fa1a47df40eed31ad6fba
SHA512 8f0d21a9e37ebc9cbb743f5b554be2fbc47fc5f194ea68709fb2dfd6ece87b245919bf7d4894c5fa836aaf6434c559ece8fa7ba054e27c9836b3af1061fcc747
SSDEEP 786432:IBI5aBnCfe+qRcIuaArPiSWwEn0GidYne5LMMm1aTiOti+p3gBn67:IBwSYZqRcIXkaSWw/PbLS1aTiOXlgBno
TLSH
T13997331597F4D269D03BC37844B70222FAB270462BB09ACF1B69947E5E377E08677B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

32:b6:06:9b:7b:f0:d1:af:ba:87:ac:5c:e0:b0:59:ac:0b:f9:3c:3a:29:5f:12:23:c7:57:91:b8:11:1c:49:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HE 411908,CN=MuseCY SM Ltd,O=MuseCY SM Ltd,ST=Lemesos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Chains

Jun 28, 2026

SERIALNUMBER=HE 411908,CN=MuseCY SM Ltd,O=MuseCY SM Ltd,ST=Lemesos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=HE 411908,CN=MuseCY SM Ltd,O=MuseCY SM Ltd,ST=Lemesos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

SERIALNUMBER=HE 411908,CN=MuseCY SM Ltd,O=MuseCY SM Ltd,ST=Lemesos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Serial Number

e5:8e:e1:85:f2:b5:6b:40:33:69:f6:fc:10:d2:6d:5e

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 27, 2023 - Jul 26, 2026

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

396432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\windows-musehub\windows-musehub\src\MuseHub.Installer\bin\x64\Release\MuseHub.Installer.pdb

kernel32

RtlUnwindEx GetFileAttributesW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW QueryFullProcessImageNameW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW CreateDirectoryW FindStringOrdinal GetTempPathW MultiByteToWideChar SleepConditionVariableSRW WakeAllConditionVariable RtlPcToFileHeader CompareStringOrdinal TerminateProcess InterlockedPushEntrySList IsDebuggerPresent AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx DecodePointer EncodePointer SizeofResource InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW SetThreadDescription GetLocaleInfoEx FormatMessageA AreFileApisANSI GetFinalPathNameByHandleW FindFirstFileExW GetCurrentThread LockResource GlobalAlloc GlobalFree CreateThread LoadResource FlsAlloc GlobalLock DebugBreak WaitForMultipleObjects ResetEvent SetEvent WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState LoadLibraryW VirtualQueryEx GetStdHandle FreeConsole GetLocalTime WriteConsoleW AllocConsole WideCharToMultiByte GetFileInformationByHandleEx FindFirstFileW GetFullPathNameW FindNextFileW RemoveDirectoryW GetModuleFileNameW K32GetModuleFileNameExW FindClose LocalAlloc GetProcessId SetFileAttributesW GetModuleHandleW SetFileInformationByHandle GetDiskFreeSpaceExW DeleteFileW LocalFree VerSetConditionMask FreeLibrary CopyFileW VerifyVersionInfoW MoveFileW LoadLibraryExW GetProcessHeap GetCurrentProcessId CreateMutexExW GetProcAddress FreeResource FlsGetValue HeapAlloc FlsSetValue FlsFree CloseHandle OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW GetLastError FormatMessageW CreateEventW ReleaseMutex CompareStringEx GetCurrentThreadId CreateFileW WaitForSingleObject GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW TerminateThread CreateSemaphoreW SetUnhandledExceptionFilter RtlCaptureContext GetModuleHandleA GetThreadId SleepConditionVariableCS WakeConditionVariable InitializeConditionVariable GetModuleFileNameA DeleteCriticalSection RaiseException SetThreadStackGuarantee GetCurrentProcess FindResourceW GetTickCount64 ReadFile QueryPerformanceFrequency LoadLibraryA Module32NextW Module32FirstW InitOnceExecuteOnce LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WriteFile SetFilePointerEx SystemTimeToFileTime VirtualQuery GetSystemTime QueryPerformanceCounter CreateFile2 SetFileTime GetFileTime GetFileAttributesExW

bcrypt

BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptFinishHash BCryptCreateHash BCryptHashData

comctl32

TaskDialogIndirect

ole32

CoInitializeEx PropVariantClear CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal

user32

BeginPaint GetWindowThreadProcessId ReleaseDC DispatchMessageW InvalidateRect PostMessageW LoadIconW EndPaint SetForegroundWindow GetWindowRect SendMessageTimeoutW RegisterClassW TranslateMessage GetDesktopWindow SetRect GetClassNameW SetRectEmpty GetClientRect GetWindow LoadCursorW GetWindowLongPtrW GetMessageW DefWindowProcW AdjustWindowRectEx DestroyWindow GetDC SetWindowPos MessageBoxW SetWindowLongPtrW CreateWindowExW SendMessageW GetTopWindow

shell32

SHGetKnownFolderPath SHChangeNotify ShellExecuteW

api-ms-win-core-path-l1-1-0

PathAllocCombine PathCchSkipRoot

advapi32

OpenServiceW RegOpenKeyExW SetSecurityDescriptorDacl GetSecurityDescriptorDacl CreateServiceW CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid ChangeServiceConfig2W SetEntriesInAclW DeleteService SetServiceObjectSecurity ControlServiceExW FreeSid StartServiceW InitializeSecurityDescriptor QueryServiceConfigW QueryServiceConfig2W RegQueryValueExW QueryServiceStatusEx QueryServiceObjectSecurity RegCreateKeyExW RegDeleteTreeW RegGetValueW RegDeleteValueW IsWellKnownSid GetTokenInformation RegGetValueA RegCloseKey RegSetKeyValueW

oleaut32

GetErrorInfo SysStringLen VariantInit SetErrorInfo SysFreeString VariantClear SysAllocString

uiautomationcore

UiaClientsAreListening UiaRaiseAutomationEvent UiaHostProviderFromHwnd UiaReturnRawElementProvider

gdi32

GetDeviceCaps

shlwapi

StrStrIW PathFindFileNameW

winhttp

WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

dbghelp

SymInitialize SymFromAddr SymGetOptions SymSetOptions

api-ms-win-crt-runtime-l1-1-0

strerror _errno exit _set_invalid_parameter_handler __p___argv __p___argc _invalid_parameter_noinfo _configure_narrow_argv _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table abort _invalid_parameter_noinfo_noreturn _register_onexit_function _c_exit _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _exit _initterm_e _initterm _get_narrow_winmain_command_line system

api-ms-win-crt-stdio-l1-1-0

ungetwc fputwc __stdio_common_vsprintf fseek fclose fflush __p__commode fgetc fread fgetwc fwrite __stdio_common_vswprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s __acrt_iob_func fgetpos setvbuf ungetc fsetpos _fseeki64 _wfsopen __stdio_common_vfprintf _locking _close _wopen _wfopen __stdio_common_vsscanf _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

isupper strcpy_s strncpy islower strcmp strlen wcsnlen strncat tolower _strdup iswspace wcsncmp isalpha __strncnt _wcsicmp _wcsdup wcscmp wcslen strcspn

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32 _unlock_file _wfullpath _lock_file

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free calloc _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _lock_locales ___lc_codepage_func ___lc_locale_name_func __pctype_func _wsetlocale setlocale _configthreadlocale _create_locale localeconv _unlock_locales

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr _dsign _ldclass _fdsign _dclass _ldsign

api-ms-win-crt-convert-l1-1-0

strtoll strtol _strtod_l

api-ms-win-crt-time-l1-1-0

_Wcsftime strftime _mkgmtime64 _gmtime64 _mktime64 _localtime64_s _time64 _W_Gettnames

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

uxtheme

BeginBufferedPaint BufferedPaintUnInit EndBufferedPaint BufferedPaintSetAlpha BufferedPaintInit

gdiplus

GdipCreateFont GdipSetInterpolationMode GdipSetPixelOffsetMode GdipFillRectangle GdipFree GdipDrawString GdipCreateFromHDC GdipSetTextRenderingHint GdipCloneBrush GdipDeleteGraphics GdipDeleteStringFormat GdipSetSmoothingMode GdipSetStringFormatAlign GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipCloneImage GdipDrawImageRect GdipCreateFontFamilyFromName GdipSetCompositingQuality GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdipSetStringFormatLineAlign GdiplusStartup GdipDeleteFont GdipDisposeImage GdipCreateSolidFill

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Sharing

General

Malware Config

Signatures

File Explorer

Muse_Hub.exe

kernel32

bcrypt

comctl32

ole32

user32

shell32

api-ms-win-core-path-l1-1-0

advapi32

oleaut32

uiautomationcore

gdi32

shlwapi

winhttp

version

dbghelp

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

uxtheme

gdiplus

dwmapi

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic