Behavioral task
behavioral1
Sample
R6DeluxeLoader/R6DeluxeLoader/R6DeluxeLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
R6DeluxeLoader/R6DeluxeLoader/R6DeluxeLoader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
R6DeluxeLoader/R6DeluxeLoader/Windows11Fix/Win11Fix.bat
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
R6DeluxeLoader/R6DeluxeLoader/Windows11Fix/Win11Fix.bat
Resource
win10v2004-20231215-en
General
-
Target
R6DeluxeLoader2.rar
-
Size
4.1MB
-
MD5
cb94c46bc34f5cd6cc5aca09077fd173
-
SHA1
994f291a3348c4b1a450ac2895920f2abc88d66b
-
SHA256
fe76161906cef3f8411791450a042384ef2eda4414302724de270c6263f1d3d7
-
SHA512
476ec3cd0f186f6d1419f6fe6d1af9fbb802e98d0e3f364460ed2a9fda4982c673807c2b0e6ea00cd2173f8ec90dfda3e3601bef22568d6c03cbebb68e75cff8
-
SSDEEP
98304:bVUYQhuormcj3hMYBcbpN8vgm+JaAkTzFTPy0:pUYJVcjRFBE/I+IFPy0
Malware Config
Signatures
-
resource yara_rule static1/unpack001/R6DeluxeLoader/R6DeluxeLoader/R6DeluxeLoader.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/R6DeluxeLoader/R6DeluxeLoader/R6DeluxeLoader.exe
Files
-
R6DeluxeLoader2.rar.rar
-
R6DeluxeLoader/R6DeluxeLoader/R6DeluxeLoader.exe.exe windows:6 windows x64 arch:x64
e7c0b82286c08d09e0f1166e14e55177
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
kernel32
K32EnumProcesses
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
RegOpenKeyExA
msvcp140
_Mbrtowc
userenv
DestroyEnvironmentBlock
shlwapi
PathRemoveFileSpecA
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ws2_32
gethostbyname
Sections
.text Size: - Virtual size: 1006KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 639KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
R6DeluxeLoader/R6DeluxeLoader/Windows11Fix/Instructions.txt
-
R6DeluxeLoader/R6DeluxeLoader/Windows11Fix/Win11Fix.bat