Overview
overview
8Static
static
3R2R/R2R.nfo
windows10-2004-x64
1R2R/R2R.nfo
windows11-ltsc_2024-x64
1R2R/XLN_KeyGen.exe
windows10-2004-x64
7R2R/XLN_KeyGen.exe
windows11-ltsc_2024-x64
8Setup Addi...2.1.7z
windows10-2004-x64
1Setup Addi...2.1.7z
windows11-ltsc_2024-x64
8Setup Addi....1.exe
windows10-2004-x64
7Setup Addi....1.exe
windows11-ltsc_2024-x64
8Analysis
- max time kernel
898s - max time network
488s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/10/2026, 22:52
Behavioral task
behavioral1
Sample
R2R/R2R.nfo
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
R2R/R2R.nfo
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
R2R/XLN_KeyGen.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
R2R/XLN_KeyGen.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Setup Addictive Drums 2 v2.5.2.1.7z
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Setup Addictive Drums 2 v2.5.2.1.7z
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
Setup Addictive Drums 2 v2.5.2.1.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
Setup Addictive Drums 2 v2.5.2.1.exe
Resource
win11ltsc2024-20260911-en
General
- Target Setup Addictive Drums 2 v2.5.2.1.7z
- Size 16.2MB
- Sample261022-2te4esf18s
- SHA256 a1012c59bb4e9e4aefaf599f178729560e04dfbbdb978610c7c0657acc7065c4
- MD5 4250f2cfd90ca1b26350adc9bfee8502
- SHA1 45c9dd345810b15a209d781b22490581f9db00d3
- SHA512 42a2e75edfb88633d1723f69d3097ef2b1b793e809554c7075992a50c649dcff53fd7766a851c14220ce7351cd4ae785132a0328e62acee5f7c05e477eaababb
- SSDEEP 393216:oaUkAHkafyeOB19cSzijWUVXb8XPtIR4/HftFHoGIjseFQ+:xUkAByeO3OSzi6l2Gn/oGIjsWQ+
- TLSH T10707335A7110397DD2F8D4B7860F7CAEB7DA2892D0E45B0FAD520B59C30AF29E1616CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4140 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4140 7zFM.exe Token: 35 4140 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4140 7zFM.exe