A_��Q�o�L ~�;c-��b�͎����@S-�r��{�*�Xxȸ)�L�&���]ґ)��J��/��J�q>���.�+*j�B�m�1�-�d��<S"��5 ���W�5��ִ~u��F��nr1Ȳ=�7�p�O*+���]�ev}���y�S��t�a�Nu]�?����5�v:*��%x�y=�a1���c������cQb�� ��֧{г�1jd������9�>�}P%sk��gX�X�ؘ�k�Eց�f��^����H�Em�/;�L�H5��Fw_ކ}V:#c�^�;� iXIڻM�� ��m������r�ɕ�+�I��އC�#�b�!�dExXF�y�(i��ޜ�TM�,G ش`l)s����/DNA6@"�-/*���G�"�bE���-�~Hd�&���ݕ��q�3����|�� � 2�z���A���a������.dTYc�3�Q�"2MUIL�y7�`nR�����i+-�ʰ5��%��5*D|�%���z��+\��ξ�����}���8}2��&����М�J2�^6� �Ҳ80�.��`���/���� �Ne�?�JzW�غ^\�֫�p��i�J�Tb���i�&����!:t�D6�V��{D�6��I��qv�� �k���~��q��NL�5�[�(�;�b��v��V bΊH�{Y��T[gZ�j�g�vq�:`��4�R\�H�pny&6��m�?g��n���^%��X<��zU㏪՝���G�T��_ᭋ��.:0�]��"��Z' �>�fޙ8;�L��\ ���Ӧ"�Ad�|c�P˰�#�Iz~����������,�g�)<R]ߘ�|�|�K���v��Dj��'C7���������L�s�Y�:�^t+ �|�o���K`�u����N럓�*k��:Z�m�0�A?F��Zl��@�O/)g���ش�$.]W���S��=c�: �Ȃ��}o�(/�����U�Xh�,���o�D�A#М|����3X�L8l��%I�d�b��Z̉�(u'��D[s�v�o���|~�P�n<� �ew�Q��汗��'��J�p����k36: Sϑ��!�&.@� ��I�F9N��H.;�Q~fZ�N灴5Ɓ���S��=��R��y:���du�4`d ��j�8����7�b���5rr�U�e]f��Iw�#��%bL�X��h�.���A�ɔȒ[�;��!P��{ �6u�o�4�z��&��1��̲�X����S�U����Z���ǹ�A��2�'�8F3Ž�4=��z�Q��c��1��8U�x� �NOcq�r�F��>�,�~���۞3�ܔ��v��&z_�)������Ȱ_w���-�';Z�+��T#���yw~Q� Hg4e��l��_�K��b�?Z�¶���9x����g\Δ췶E*hV�����a�H�����#��R�!� т�P<�qV��M5�e���x�;@B�U8Ǒ������ Y�4����5�Z�m�N�[b���1��\�+�&�����*}s����_t7�����4�#�����DhW@?����"���ݾ~�km�i��ck��ep��S�_B�PU��C>/�g�G�!C��ia 車�B_�f}3�+3�0�ax�.b,�3@�-%3z��O��e���_V듔�`u�9Тx� DK� ���g,�+��"�$��Ȟ��G���)j:�y�>1���?x����uh:#��ni��>�ě ��5ՠfq�m����,vn�j�;ՠ�W�w���#w㰵��-�Z��n>y���]-���m���Si��*̭�j{���&�π���!ځ������jF]W- �����֤����,��� ���*����J*���NB�y��]z��+�Ur6Ƶ��>g/wF�WDM��ux�� ���G��-_�x���w�|���>�Jm0�r1;�rn����K�e�|��~>u�O���ԖqLF ������������~��G���Z<��]2�-�輽�e4�(��KP��1�ވx��4� KL�K�E�I��XT/�+軈LӕyX���>O_��jg��[���"B�Р��#��%��(? �;���;����t�`x�%�����tkvC�Hz`N�=x�jʸ� � U���WACP*$����Rϰ4鸤*m9�祾T�ʀ˗�/0�$�+bj���|�'Ϡ����4��x������_.â|M9��t#P{�O�z�us?v}.&C�9�E�b�2f{@�JS'�_0���@BA����O({���0z����z�w�j� ղ3�0�L��9�^���^h��9?�>T�����\6П��� ��`e;�a�8CgPw�I7��L;��}�X;R�����JOv�kV�s�������t���M�E��T�x��W+' Ɖڏ���e��a.�մ1�4���04M�/���Xr��3C�(%��� {�������4>~�P!s��{AH��\��|�i`��w�a�j��G�V"�ߓ�8�{�=�8 �P�F֝��g��&ROMI�*|���NS8O���O ����Q��K���6��Z ��� �_ ��;�)]����M�ئ���5q��L^� ܢ�|� �aI��蝐��bY��~�B���i�A��0��1�<���I@��� @T�x�M�:24j��K(����/�߷2ǔ�]̆iR�ƥU���{h�:7q�E�7 ���q;�I�+��NJyv@;������ȋfJf r�>��q�]zHa|q��ZC�z��LÚ/�K4=n� }=����ؚG���y7�j-��H��8 CW����R���eG1Wɼ�T(ߏ�BB aw4�ϿN'��xA{�P8��$-_c@�!�ҕH�K�A��~�usB�l���X��{H$�X7�,L�B���'hC��N[���zV�>�g7U��l�~�H�����G5�0��/v�¹��z��[�n"�k{��?���3{`W��k�l�m��ćےl��=x���f�$�i��Z����׀DU,\�Hl?���\>}��V��$����c*2�E�@� �J)'�VW�^
Behavioral task
behavioral1
Sample
Devious R6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Devious R6.exe
Resource
win10v2004-20240802-en
General
-
Target
Devious R6.exe
-
Size
10.6MB
-
MD5
760c2983eeb07d48bde7c90760abc5f4
-
SHA1
f34c4a9ea9263ac18f199c0c50b0808b3994fe64
-
SHA256
65600bd25f41407537e12221b4b849dede8f00f337aa22f54f164907f5368f6c
-
SHA512
66c715c9e3acb22074de917b32db13119d7875b483baa47763cca475d6adc7eb5fe614f89e10ff68aff0c13e591707f1895c786d708e58db1bff7c195fd48540
-
SSDEEP
196608:D+710oZKNzIXwB8iY5Q1tPAzXmJOJaIgUY/g3L6+UR3gw9EOUNd2qDgX:D0ZKNmwr9PPqXqOJaDUrL6NRwwQf2qD2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Devious R6.exe
Files
-
Devious R6.exe.exe windows:6 windows x64 arch:x64
130bcd7e14e999ec89d797a1bef036d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
kernel32
HeapFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFreeCertificateContext
ws2_32
closesocket
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_gmtime64
shell32
ShellExecuteA
advapi32
CryptReleaseContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 413KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ