General
- Target SoundPad.4.0.9.7z
- Size 7.7MB
- Sample261113-e14n2af16p
- SHA256 a45087763480221f92d9ffff8cf331759f5a58b66fe85c576f93953e70a943bf
- MD5 f6a2e12a9979ab479c0bb5a53681ce42
- SHA1 7594bcabf2f18932a97b14725ea0b0dec40c4a59
- SHA512 ac776f5c52ec78bc16abafbeb30017055dfc81f9ded187d248346160d54f1e7882ad5931736541cf412850b15144f71f00a6c1ccace4f804ba0656144f96c9da
- SSDEEP 196608:6iwlogjarpn4RYlUFLu25sN9njPVw3ULGq8A:6i3oI97Vw3/qH
- TLSH T128863318B60B8F3931EFBC2953892B0E51594B004407AA17547E7E9F07E74B1E9BC9EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
SoundPad.4.0.9.7z
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
SoundPad.4.0.9/Soundpad.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral3
Sample
SoundPad.4.0.9/SoundpadService.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
SoundPad.4.0.9/TTS.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
SoundPad.4.0.9/UniteFx.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
SoundPad.4.0.9/unins000.exe
Resource
win10v2004-20260911-en
Malware Config
Targets
-
- Target SoundPad.4.0.9.7z
- Size 7.7MB
- SHA256 a45087763480221f92d9ffff8cf331759f5a58b66fe85c576f93953e70a943bf
- MD5 f6a2e12a9979ab479c0bb5a53681ce42
- SHA1 7594bcabf2f18932a97b14725ea0b0dec40c4a59
- SHA512 ac776f5c52ec78bc16abafbeb30017055dfc81f9ded187d248346160d54f1e7882ad5931736541cf412850b15144f71f00a6c1ccace4f804ba0656144f96c9da
- SSDEEP 196608:6iwlogjarpn4RYlUFLu25sN9njPVw3ULGq8A:6i3oI97Vw3/qH
- TLSH T128863318B60B8F3931EFBC2953892B0E51594B004407AA17547E7E9F07E74B1E9BC9EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
-
- Target SoundPad.4.0.9/Soundpad.exe
- Size 11.6MB
- SHA256 17e162eae3204595e6e0806599fbb9e12f721aea16597307dca0ee9c25204d39
- MD5 c68f3f2622c4b536eec4da473c294190
- SHA1 db4481248e32fa14b253d839b1809a55042039d2
- SHA512 08a2aec7df0eb5a24c1a73ad46b92ad4263eac3cf70645e6dc6ea8ea187f7ec302aa92f6fc72e698747074ec2fbe5c09ce6833f1eb8afe22473d375bfdc52d77
- SSDEEP 196608:GAce3mzQ0ZDKIfy60DOe+td1duxkelckFU:YVXKIf90DOec1dul2kU
- TLSH T153C69E1AA3B600FCD4B6D0BC89539903F3F33846173597EB05A18A6B8F1B6D19E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops file in System32 directory
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target SoundPad.4.0.9/SoundpadService.exe
- Size 552KB
- SHA256 a5fbe4ff740558dd6872ca9992d6d25ce8d94b79acc3665733bb181ff9364972
- MD5 c830c0bec2b3e128fb12ff6529853009
- SHA1 2d877dc64575276d3f5d8994fd7e762df62a20be
- SHA512 085dd701e83ad3df7371336d6067749619782b68aa3638d6351b49dccbb074111290e819712ea55e42dd73fc44751f654b3fb83fa1d77fb31164dca2f34bed38
- SSDEEP 12288:YiKmjJh+Ql63nqI03OQSZ+VI8MGbczY7UkDZev:YiKGh+Ql6JQg+VI1Gh7UkDZev
- TLSH T12FC47C55A2A843F8F1A7E17889854506F7F1785623219ACF43F04AAB2F276B11F7F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target SoundPad.4.0.9/TTS.dll
- Size 156KB
- SHA256 7ba8f0713edad79c587c8385556a0d7605070ab187c0cab2ba116a88e5950178
- MD5 8f1b8dc26a9531f76d3057c7a9f0b5da
- SHA1 bfe59535db9e09630906539c91894e3afd72fc14
- SHA512 ffeb0e43d7a12adf005b9ce1696c41fce734f31168ee44af20f4e9aaef27561f2a37e8c8aaaf7cc9aa1e13c8178e33f391de645a99c8e0226f73cacc71bd6d63
- SSDEEP 3072:AzXW6K7StnPWyxF4LZaKyYYDTEFHR7+XDPq2iHAbD8ev5QTHlUhFA7Zez:6XW6K7SJP+WvTYHZ+XDuAH8ev5QHlGAC
- TLSH T128F36C57B3A541BBE5678238C4834A02FB7278110BA09BDF07B4476E1F277D1AE39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target SoundPad.4.0.9/UniteFx.dll
- Size 581KB
- SHA256 16b9bcf7be1fc7829299229323efab0e9c9594c626eab6ff0bff8eb7495ccf60
- MD5 9feae88cb8eff25628382749c84ac55c
- SHA1 9c4f308e0b7a6f4e71d62a671607ffe8ca56e51c
- SHA512 c381ab754b8b0db482c4893f279d76063dc65238f1a0331dd887ed4e3e3ffc7ec5ec34205fef98121cc8b1f4b38116fa16820ff8ad887ccbebbb677642a671e1
- SSDEEP 12288:3bMYSzbsXmJmD02otfTo98md2FMN/a9oOt0q+LZeb:rMdbsXmhfTomSKMA9tt0q+LZeb
- TLSH T19EC47D2662E841B8F177A17489874516F7B2785623719ACF03F086AF2F277B15B3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target SoundPad.4.0.9/unins000.exe
- Size 3.1MB
- SHA256 5993a5b1852bee40acc1ae2a3c5d365c7f140e1cecaf81664eed085f7ed70046
- MD5 1e3ed997ff4eaeb69019d416401d34f7
- SHA1 af7150afb74bd3b3d83a19f720c0b342875ef936
- SHA512 e7f6835cdb0330bc5e5c04dd2b90efc21313730222e0f70568c10ebfbecc0c4518459e51f35292181f82272bad2a506cc8887448aa2f0547a141e5f8b6656a0b
- SSDEEP 49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYL:CtLutqgwh4NYxtJpkxhGj333TS
- TLSH T1A3E53A17F38C713ED06B3A364A3386909837FA6169168C2797FC794C8E365942A3E747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Deletes itself
Executes dropped EXE