Overview

overview

7

Static

static

3

river.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    river.exe

  • Size

    36.2MB

  • Sample

    240228-3hcdtsgd62

  • MD5

    dadbc498ff01882ebfba8fe7da4ae5f8

  • SHA1

    3e05361986fc76030bfe20bfcd264accc6857f96

  • SHA256

    dfe856e52dbaec67d8bd5eebc2964e713c0ab6e74d7e4529a99d387068c18adc

  • SHA512

    09807b5c0e06406decc101f986de904995bdc39e99d9de8d69663856a1c046a4712ac8d51d04407d01c7928961b1619e9b5125f9ed4d46e5a672a7ddbed0c715

  • SSDEEP

    786432:GSQts3IKmr2puIha22j6+s7LWB75zuk2k5F0wW8p2OofBHgUb:GSQt+Ifr2pBha22qHWB75ikPztWA2Tfl

Score
7/10
pyinstaller

Malware Config

Targets

    • Target

      river.exe

    • Size

      36.2MB

    • MD5

      dadbc498ff01882ebfba8fe7da4ae5f8

    • SHA1

      3e05361986fc76030bfe20bfcd264accc6857f96

    • SHA256

      dfe856e52dbaec67d8bd5eebc2964e713c0ab6e74d7e4529a99d387068c18adc

    • SHA512

      09807b5c0e06406decc101f986de904995bdc39e99d9de8d69663856a1c046a4712ac8d51d04407d01c7928961b1619e9b5125f9ed4d46e5a672a7ddbed0c715

    • SSDEEP

      786432:GSQts3IKmr2puIha22j6+s7LWB75zuk2k5F0wW8p2OofBHgUb:GSQt+Ifr2pBha22qHWB75ikPztWA2Tfl

    Score
    7/10

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks