d2615ae1a7a1c02f2abecdbd11aebdcd792023689de9ebcc9032901755dcf452

Analysis

user interaction
yes
max time kernel
300s
max time network
258s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OBS LITE .exe
Size 65.0MB
Sample261107-3j2ecasw4j
SHA256 d2615ae1a7a1c02f2abecdbd11aebdcd792023689de9ebcc9032901755dcf452
MD5 88e260bbbd645198ec5253859969241e
SHA1 59b37ae2413f12e03a8d77eb0029beb565885913
SHA512 7836b6b6defe40efe38dad37cab84317fad7f0e2ceb48f5c03993998046447ae15b14dd213556e68d3404a12ceb2ff92e501dee960a608e757b26bf8482bb351
SSDEEP 1572864:e8ncu+0UiNNLI0YHitG3wbs/pekiNb2yiF5wcFpQcRQrwQTlH3:eKcu+0bNakGAIek5zpgpJX
TLSH
T120E73332764F4993CD2312F9761248354AA6BB614432D1EF833B47AD2F1E1F9862CB79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OBS LITE .exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1228	OBS LITE .exe
1228	OBS LITE .exe

C:\Users\Admin\AppData\Local\Temp\OBS LITE .exe
"C:\Users\Admin\AppData\Local\Temp\OBS LITE .exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Icone blue.ico

Path C:\OBS LITE @johnzinntv\App\Icone blue.ico
Size 9KB
SHA256 9ddec2fd7665dd9960dc8a3ef359b48828f421a5dee6619ab925823bc51fecbb
MD5 704e20a5f4a730d0fd88858947a2ea79
SHA1 eae6b1b73c4ac455545d6a7b6a0df768f2a2263f
SHA512 591cc688092bb1dbe4ea8f9b0650887f3f1b4ccd1b49bb83e03f03de43aeacf309a16553fb4b51734022bd3a4ce543380277ca2ac4d35d02eccad55e7d267266
SSDEEP 96:91q4pI8q1y877kLHIiz28h9FqYXjIwwR4Aq:yjF7sHI4z9Fx3Aq
TLSH
T1D51298FC59CED937C90699394779C7FE9D67CD42C06B43CF883BBA2080A8AD56412298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obs32.exe

Path C:\OBS LITE @johnzinntv\App\obs-studio\bin\32bit\obs32.exe
Size 2.3MB
SHA256 7233c04da3269e081f56a9c7c24c6cc85bef39e520b33cc86a99a1c0d8136c29
MD5 7f5cb4ce4449e5c65a5a14aefca54a9c
SHA1 6ba6143ac8bb999d843af8b93587c09d92af7ac1
SHA512 4c6ebf6181610fe5fe70e48ddfa34cf041acc9880117a153b9f3f121f40f60e350161ca5fd5907770f14e164723992d48b55a9a94312fcb99bb5207dd3555f90
SSDEEP 49152:XFyz7X8oec5OdYIkhibAoesl/RFwwD2iulCzn:XFM7MRc5OdYLiMgwg
TLSH
T115B56D31A604C139D5625070752CABEAC89DAAB41B9AE4C3F2D84EED39B41D3C53DB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr-CS.ini

Path C:\OBS LITE @johnzinntv\App\obs-studio\data\obs-plugins\obs-text\locale\sr-CS.ini
Size 976B
SHA256 d4509d8ccff0be13adbc4607370fa5d18905401c0e43b7dce700e2e75bcfd3f4
MD5 e2fcdd26036e5bb1994017e0eaa39976
SHA1 68329b1b2c2cda112603d22a36f417ec1dae1f2d
SHA512 333eaef88a61db0d9ad29a4f849f2fe7099f6dffa36f1733dac9f1a42a691750fead4d9be95e0588fe57d262c6798babd86d44f9fa1a0511a106862d17c82d7a
TLSH
T12611D011D3E95E61C1B0B64F6661DBE533F305E20ACC18E4ADD80B8741FAD2E36645B5
MD5 SHA1 SHA512 TLSH

Submit Download

sr-CS.ini

Path C:\OBS LITE @johnzinntv\App\obs-studio\data\obs-plugins\obs-x264\locale\sr-CS.ini
Size 410B
SHA256 42d7adbf9bd7a14fb2cdb59445df9a0944d6be7841450c94109de482e8e9612e
MD5 71454981cd2074a43d58fc67fdbed5d7
SHA1 f5c803ee1e0fe28ca81d84c48f6753afca23929e
SHA512 9ee79b34db6b785d9252e5562d958a250244283bd8f5cfc9fec89df5306393a75d0c1a97bc9e27727267156b9f38477f21dd0156b07756f39547e1c63367a0c6
TLSH
T12CE0AB4749B51F75A9F01CD897026D1C1F3C94099E63A1BB1CAE20E841C704295ED76C
MD5 SHA1 SHA512 TLSH

Submit Download

sr-CS.ini

Path C:\OBS LITE @johnzinntv\App\obs-studio\data\obs-plugins\win-wasapi\locale\sr-CS.ini
Size 154B
SHA256 e2671c1dccd4cbba04c9414c60ad2df3fac6e8e0b830e1cc1e800c0f4b232a6c
MD5 e592797b0991fc171bcb45d711fe9548
SHA1 6eaf59d6d03dd81bc02f6d3f78911b2ec0a21dc1
SHA512 564969dd45df576e6b5ca96395b31b52fc30f59c7399176ff60d28ae95cae4a923b235fd3e200fae09160d874ba666fb9bfb1180d4d7faf15a6801826dc8677c
TLSH
T10AC02B36B42BC75F10D72D3C9C9402C032B04560C40461D28406DCA43971E81A10410D
MD5 SHA1 SHA512 TLSH

Submit Download

media_play.svg

Path C:\OBS LITE @johnzinntv\App\obs-studio\data\obs-studio\themes\Dark\media\media_play.svg
Size 160B
SHA256 833ec0ec55bdad8ea074a9edf5c7d9e5d96964bfbb4c62f7eb160a8877e3e2ee
MD5 d8307416756e31785bd73c4e22dbb878
SHA1 2672fb759089fb195214d908308f05ff3f5810e6
SHA512 f09aaf657f95eedf16d86fd63ad29e41b536c1ca74cee7af8cb9433dac58119f1cb7eb63220bfb66175c9b93a8aafbe572420588cb63fdcae973615645c0a814
TLSH
T1E5C08CAAA07C4808961856118AEC688450ADE4A392A101BEEA9028272C2549AAC6E2AD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads