General

  • Target

    ReksFN_S13_Installer.exe

  • Size

    49.8MB

  • Sample

    230526-zk2jyshb37

  • MD5

    f91c368df806768b95e87f303baf3118

  • SHA1

    f8abff860a8269ab534aee69736c3d6683c77364

  • SHA256

    a8ff885a9d97309785c7ad0c1adb5fbac0887f88294e29b106143e29409b5f2a

  • SHA512

    fd56e97a480362b1363caa344d98b826fec4cbac470c5ed98d5a88586e5adb4b55ae40131dbc37e9cc800b3932b021696f5a6ac2cc496c055796c7c6a43999f4

  • SSDEEP

    1572864:jmsej1oVeC/UYRaI9IEa8rPK6VmSPft03:NejRCR7aiKwrPF03

Malware Config

Targets

    • Target

      ReksFN_S13_Installer.exe

    • Size

      49.8MB

    • MD5

      f91c368df806768b95e87f303baf3118

    • SHA1

      f8abff860a8269ab534aee69736c3d6683c77364

    • SHA256

      a8ff885a9d97309785c7ad0c1adb5fbac0887f88294e29b106143e29409b5f2a

    • SHA512

      fd56e97a480362b1363caa344d98b826fec4cbac470c5ed98d5a88586e5adb4b55ae40131dbc37e9cc800b3932b021696f5a6ac2cc496c055796c7c6a43999f4

    • SSDEEP

      1572864:jmsej1oVeC/UYRaI9IEa8rPK6VmSPft03:NejRCR7aiKwrPF03

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks