General

  • Target

    EONLY.7z

  • Size

    241.1MB

  • MD5

    7f906ee671be2bcedce725aa77ca60e1

  • SHA1

    d8766f0b8a1988757bb7d130d0f589590712f2e2

  • SHA256

    24e8c911a34e784acfeae70252c1c4c27c7d40883eeee9871d97691bcc0f9df7

  • SHA512

    9e5101d4cf2b9ffd1a457f13307ccecd207f36d12106e149818f28af6654dc2b1c2ad6896e77128b35bdd6468651898bcb774d5f730f61dd9b788cade751d84f

  • SSDEEP

    6291456:CqJVpdZphF5kuf6k4iQdLdau2xAEtkHZv7Oe1Bob3k0gnpL2:BZphFf6k4x2qEVe1UCp6

Score
10/10
r77

Malware Config

Signatures

  • R77 family
  • r77 rootkit payload 1 IoCs

    Detects the payload of the r77 rootkit.

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • EONLY.7z
    .7z
  • EMPRESS.nfo
  • EMPRESS/EMP.dll
    .dll windows x64


    Headers

    Exports

    Sections

  • EMPRESS/amd_ags_x64.dll
    .dll windows x64

    faf765fd60cb2e7facdf2399d5ac4e09


    Headers

    Imports

    Exports

    Sections

  • EMPRESS/re4.bin
    .exe windows x64


    Headers

    Sections

  • EMPRESS/steam_api64.dll
    .dll windows x64

    c69c22b5a3698527f0d3c9618c3affbd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EMPRESS/steam_api64.emp
    .dll windows x64

    7579a056233ae9138efabc7a2d6c52bf


    Headers

    Imports

    Exports

    Sections

  • EMPRESS/steam_api64.ini
  • Extras/Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
    .exe windows x64

    335b5e5300d836a684f2d89f4a7851b9


    Headers

    Imports

    Sections