Overview
overview
3Static
static
3Neva_--_fi...01.rar
windows10-2004-x64
1Neva_--_fi...01.rar
windows11-ltsc_2024-x64
1MD5/QuickSFV.exe
windows10-2004-x64
3MD5/QuickSFV.exe
windows11-ltsc_2024-x64
3MD5/QuickSFV.ini
windows10-2004-x64
1MD5/QuickSFV.ini
windows11-ltsc_2024-x64
1MD5/fitgirl-bins.md5
windows10-2004-x64
3MD5/fitgirl-bins.md5
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
Neva_--_fitgirl-repacks.site_--_.part01.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Neva_--_fitgirl-repacks.site_--_.part01.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
MD5/QuickSFV.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
MD5/QuickSFV.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
MD5/QuickSFV.ini
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
MD5/QuickSFV.ini
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
MD5/fitgirl-bins.md5
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
MD5/fitgirl-bins.md5
Resource
win11ltsc2024-20260710-en
General
- Target Neva_--_fitgirl-repacks.site_--_.part01.rar
- Size 500.0MB
- Sample260831-qf8m2avyfs
- SHA256 cb197e9ae1947655378fe7fcdb3b1ba5e10a4da42387ee8df52fbb431977f079
- MD5 2ea49ec5791b494790398ce7375ad3a7
- SHA1 6abd59262aaae305e0bf8bf430ce82fce2c67d03
- SHA512 a91d01f226f7bfe787eb6f0dbc09b8d79a2e644a7a450582a43cb6f054f5b3a42785419ceef924894910a18576f17fe3a7d2a8e7718ceec0b4a1de5bdab9a772
- SSDEEP 12582912:qYa1og4kuhTI7xMxgYbc2UunsBQ9pwr4XdwTaZjDXyC:qryLbiQUu+2u4tw8iC
- TLSH T1AA493343E95B4AA5C43DE5B5AA4CB01752F1D33B5EF28473828BB41564EA360FE00EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5820 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5820 7zFM.exe Token: 35 5820 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5820 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Neva_--_fitgirl-repacks.site_--_.part01.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5820