Spotify-Discord-Lyrics-Windows.zip
- SHA256 d99228fb52087fe4225024765ee1c2a8cc5a5b61246efb0e9fc3618fe1cf1527
Overview
overview
7Static
static
3Baslat.bat
windows10-2004-x64
7Baslat.bat
windows11-ltsc_2024-x64
7Otomatik-B...ir.bat
windows10-2004-x64
3Otomatik-B...ir.bat
windows11-ltsc_2024-x64
3Otomatik-B...ur.bat
windows10-2004-x64
7Otomatik-B...ur.bat
windows11-ltsc_2024-x64
7SpotifyDis...cs.exe
windows10-2004-x64
7SpotifyDis...cs.exe
windows11-ltsc_2024-x64
7SpotifyDis...er.exe
windows10-2004-x64
7SpotifyDis...er.exe
windows11-ltsc_2024-x64
7Behavioral task
behavioral1
Sample
Baslat.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Baslat.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Otomatik-Baslat-Kaldir.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Otomatik-Baslat-Kaldir.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Otomatik-Baslat-Kur.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Otomatik-Baslat-Kur.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
SpotifyDiscordLyrics.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
SpotifyDiscordLyrics.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
SpotifyDiscordWatcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
SpotifyDiscordWatcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Spotify-Discord-Lyrics-Windows.zip
- Size 18.2MB
- Sample261027-eex95a1vcw
- SHA256 d99228fb52087fe4225024765ee1c2a8cc5a5b61246efb0e9fc3618fe1cf1527
- MD5 b2f06da63d132e391ab2f225bce099f2
- SHA1 510ff356ad3e15e5bc94c55284a920af138995ed
- SHA512 fc10275fb51e36e39168b6b66108b3411cc16c97699d2ea57f5019bdc718f50e0e14d268074934e2ec074dfa773126181052c76461f0bdc139ffd6ddf64660e6
- SSDEEP 393216:Qn5vfq45rfZW+LgC5iMiGP8rHi71a336fJvf3S9zOEQuqfOKeXmdiAdAhydqyFU2:KvigrflgCCGP8rHi71hJv/mzjQlOpdAN
- TLSH T1F21733F2C2731D7DC6C4D98A21F583A8A31546EEB19E309BDAC00BC29F1E76B8935D51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/SpotifyDiscordLyrics.exe pyinstaller static1/unpack001/SpotifyDiscordWatcher.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SpotifyDiscordLyrics.exe unpack001/SpotifyDiscordWatcher.exe
File Explorer
-
Spotify-Discord-Lyrics-Windows.zip.zip 18.2MB
-
Baslat.bat386B
-
Otomatik-Baslat-Kaldir.bat.bat .vbs 870B
-
Otomatik-Baslat-Kur.bat.bat .ps1 1KB
-
README.md8KB
-
SpotifyDiscordLyrics.exe.exe 9.3MB
-
app.pyc3KB
-
SpotifyDiscordWatcher.exe.exe 9.3MB
-
watcher_silent.pyc651B
-
config.example.json400B
Baslat.bat
- SHA256 1323a754893537162d0938774335604f79cd7c3035e85835cc0008ec3118b528
- MD5 6ddfa294de76d7a9ad94835381912070
- SHA1 d6b80c03c18124661b9880e51ab8cf33483134cd
- SHA512 bcd1d545edfecf053c8d07b79cb7f0d5ce4d5e239c63de858ac256e8ba6ba94c83aea1f185d7d5b6d49a4fe0f0d2c7f33f979bb2bc546ff28828203a46c02a1b
- TLSH T1AAE0C242B011CD00C7B413AD55743649F60F14A7CA4B9805392701A90FAA3EDAE8E862
- MD5 SHA1 SHA512 TLSH
Otomatik-Baslat-Kaldir.bat
- SHA256 d5c98b142e4d1460bb7fc8b9ea33d5f6410b4b606f9df7f32345d56acace62eb
- MD5 6eea0bd6b4c0e982f30bfe190e0d2383
- SHA1 3e8af89a2d67f5b9e57b58c7926221d2b79c6737
- SHA512 5e885087431ab62f61937923e5f8608fef24162c17cf068f83a52024be4e45e8e317bc81cd2e63c39b0b0fd8514a5fd7d77392ca5ab1b0f480a7d24a5f428c79
- TLSH T19D11FD22782A0500C9BA73C488552249EB09C8CF0AE2BE9DB54B10394F447E3D2BA1DA
- MD5 SHA1 SHA512 TLSH
Otomatik-Baslat-Kur.bat
- SHA256 910dd39737603e6312beaf174de439c86e7b867bfac2bbdef9bc9421f5d9d58d
- MD5 4ca017efd4d948a2661c5b5a7a3e4fc9
- SHA1 b52b68f4433ba2c32eb36ae159ffe09f94b4698d
- SHA512 5d1a2ffb5c7addd906fd3e0a9777b1f0e9ad4805b0116c2c9e680c71a64d0869bdc572f5b65f3aaaf3ffa015535bb5a4e56af4018fc28ea3d20058b662c2e536
- TLSH T189211022B1698B2049BAA354CD1D2495F70380EF127AEC4E7A0F842A0F943D3C5F89C2
- MD5 SHA1 SHA512 TLSH
README.md
- SHA256 7372d02ceaa4e24df43401f2cc42af23fc049480cea4445b5cd106aa13741133
- MD5 2040ebffbd6dccb42dcea700d7084b2f
- SHA1 8f4e1206b25e276147caa118fc2530dd09165492
- SHA512 3fecf68895898f6e47ad46c1a35a03c9ae94587c9bd324ad28e42eb4600534c8e953b32bd4f3746645b0c5209858cfb886128a14945dd1231be870833eed25ec
- SSDEEP 192:PclFWcae27zmfihegsW6jfPs1GhVObh7TiC:PSUcae27zmhXW6jfPs0VObh7TiC
- TLSH T1D912B792541BBC2D6BF507CFA0450527F35F635BA86B640DF55F322A3F652428388E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
SpotifyDiscordLyrics.exe
- IMPHASH ed71b47f404234b025eb1f9c0778046c
- SHA256 080104c9d1286059423bd8fde7a7057eb55d851b0afd197d0857b580ad6cf011
- MD5 22e2e3a5c6aa1aa4873be3118f0b1a05
- SHA1 7dcd01d59e9b83f48e59b0f83366c533e76ad2a3
- SHA512 bbc504ed01a7d1a875ac79e0ad10bd6666754d4cfd8b0c26fec6b1b1bda99328c3ba15f3b6a25180f10f9931233ba12553f8681dbef0e6bdd0656ae4950cefac
- SSDEEP 196608:UYlNTwhLFvf2A1HeT39IigwK9auDXURuAEk0ax8Z8E/9SNz:HSLFvfv1+TtIiFFuARuAUax68E/9Y
- TLSH T116A6339593E208F9E9F6813D81B6C16DD222789B531A93CF63D00A933F177F24A39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
QueryFullProcessImageNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
app.pyc
- SHA256 c18fa9bc1234bf8ada01368cfb19fadf0d3f3004d61f73bb759b813759474ffc
- MD5 c01de569b1ece961d976fb17f50ce8a9
- SHA1 ccedb7a82d398e0ad60a54eb0ddce2c40d52c391
- SHA512 12f70b0591d90d26f70a162e7c941ce5d2e7ed4abfc834f9c55d72fca6e87b49de69f638b6ee0002c6fe5826d4432e1d9966660c8c632ea14bf67936e32894d8
- TLSH T1CC71F085A783D8BBF8B89730DCA23E0B3775D5F19720C76B2626D16B6D5A3002D415CE
- MD5 SHA1 SHA512 TLSH
SpotifyDiscordWatcher.exe
- IMPHASH 1dcd477cce07724ec6b817b3be71540e
- SHA256 16ef937ae36455ee5d3cc7669043b69760142bffce6c22a9b9d11ac740dc075b
- MD5 377bb057303e0f97fff5694fe75536a9
- SHA1 7332a1aa8de8977f542c2c3ae8e0bc23362b6ef8
- SHA512 d8c89e5d3f7837f2a7afb1d77299ebf476e4e64a72e5bf86229971e8cb0468fd0825c914803d1442d7043861e621cf348540ab9159ae094964a33e3928e314ae
- SSDEEP 196608:xlNTwhLfUvf2A1HeT39IigwK9auDXURuAEk0ax8ZyE/ySDz:xSLcvfv1+TtIiFFuARuAUax6yE/yi
- TLSH T187A6339193B208F9E9F6923E82B2815CD272789B4369D2CF17D007926F277F14A39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
58128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
QueryFullProcessImageNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
watcher_silent.pyc
- SHA256 e2f5348a22e342549645c484181459334e059a7dd718dee18950abcf0ece460d
- MD5 8c57fe8f8f8753319c6bc526ca90039b
- SHA1 83775362ce03a651947e35840d45580c86fcaac7
- SHA512 f48fcd0073a8c971900e5ffc33753ca68555c483e4a73106fde0ad75d551cf49bbcd05ba7fda62016ca15a2e8f3bddaf9f43e176da10138607a6caad431c398f
- TLSH T107F0E180E6A380F5D198AA30F8312B04313AE894A260804B630B56157E9C2048C17599
- MD5 SHA1 SHA512 TLSH
config.example.json
- SHA256 4b4fb5875b4e24058666883f8d2440ee5f90620c3299ada2c5e1a30ce4b0cda9
- MD5 0c99e8268c9419583f247af6ab7daad5
- SHA1 05c88f461bd1418bf0499ed7abf2d575d5484a50
- SHA512 c20c5b7d322150797db68f4e38cf9e5078726895c5e0d592e48b48d10055e94a3cc725a213f5e5dcba0c230715c25a3a2852b792eced1456ee004e73a14ed926
- TLSH T1B9E09A17D2594D1308F8462728BA5202FA214F1F24570C0BBAB5A89C4FBBB12828EE26
- MD5 SHA1 SHA512 TLSH