General
-
Target
ReksFN_S13_Installer.exe
-
Size
49.8MB
-
Sample
230526-zk2jyshb37
-
MD5
f91c368df806768b95e87f303baf3118
-
SHA1
f8abff860a8269ab534aee69736c3d6683c77364
-
SHA256
a8ff885a9d97309785c7ad0c1adb5fbac0887f88294e29b106143e29409b5f2a
-
SHA512
fd56e97a480362b1363caa344d98b826fec4cbac470c5ed98d5a88586e5adb4b55ae40131dbc37e9cc800b3932b021696f5a6ac2cc496c055796c7c6a43999f4
-
SSDEEP
1572864:jmsej1oVeC/UYRaI9IEa8rPK6VmSPft03:NejRCR7aiKwrPF03
Static task
static1
Behavioral task
behavioral1
Sample
ReksFN_S13_Installer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ReksFN_S13_Installer.exe
Resource
win10v2004-20230221-en
Malware Config
Targets
-
-
Target
ReksFN_S13_Installer.exe
-
Size
49.8MB
-
MD5
f91c368df806768b95e87f303baf3118
-
SHA1
f8abff860a8269ab534aee69736c3d6683c77364
-
SHA256
a8ff885a9d97309785c7ad0c1adb5fbac0887f88294e29b106143e29409b5f2a
-
SHA512
fd56e97a480362b1363caa344d98b826fec4cbac470c5ed98d5a88586e5adb4b55ae40131dbc37e9cc800b3932b021696f5a6ac2cc496c055796c7c6a43999f4
-
SSDEEP
1572864:jmsej1oVeC/UYRaI9IEa8rPK6VmSPft03:NejRCR7aiKwrPF03
Score8/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-