General
- Target p9atmq5-rsspi.rar
- Size 95.2MB
- Sample260628-2pd1kafy2t
- SHA256 a0db509f6c6ae043a22ed5f5324daa5843d4026bd972fb75efb64c575d866830
Score
8/10
Malware Config
Targets
-
- Target R2R/Spire_KeyGen.exe
- Size 1.5MB
- SHA256 392052c705bbc5dce6e44e84db34479d9f9029228ca2b2d55827419a45a4adb6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
Score3/10 -
- Target $TEMP/R2RSPRKG2.dll
- Size 91KB
- SHA256 805871aa8f093a5c05fb0281ad4cb272ee2fdbc77e31b9054e5335425dfb943b
Score3/10 -
- Target $TEMP/keygen.exe
- Size 492KB
- SHA256 aaa155582f5bc6e78170c097578b2469466971859402eca7bc99f3f2aec7f18d
Score3/10 -
- Target Setup Spire v1.5.19.5943.exe
- Size 339.5MB
- SHA256 b67dd1d7318e12b0827ef30a5ca12333b488120b077605d2d0462ecf00ae6449
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.