84c7b0b7be794aadff37bf25b506bd05095aafa6b965a710374224d407b82bfa

Sharing

Copy URL Twitter E-mail

General

Target
R4i-V4.3 Spanish.zip
Size 29.2MB
Sample260702-rv2npsc18r
SHA256 84c7b0b7be794aadff37bf25b506bd05095aafa6b965a710374224d407b82bfa
MD5 ed5c93864de34af4ee72375eb59646f4
SHA1 34b915bd91bb929e0d2d164ce245d2685d4f63cc
SHA512 d7d424e41e142237ec34a3abe0832240be5d25852408f4dedd4834e29d036a2bc693c438d4b753b8de4715d8195624da3deca3b0049d5161e3e699df3d02c488
SSDEEP 786432:peWPpcdpFPbrZmcnQmPxhw5Cpm+L48MaoHDbwbnSN:peAp2PZvXZhw5km+5oHPwbn+
TLSH
T101673398B9CD0B8DC16D767D9A62A70221587B484C3BCC77C98907C9FEE94F6A5F3180
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  R4i-V4.3 Spanish.zip
- Size 29.2MB
- SHA256 84c7b0b7be794aadff37bf25b506bd05095aafa6b965a710374224d407b82bfa
- MD5 ed5c93864de34af4ee72375eb59646f4
- SHA1 34b915bd91bb929e0d2d164ce245d2685d4f63cc
- SHA512 d7d424e41e142237ec34a3abe0832240be5d25852408f4dedd4834e29d036a2bc693c438d4b753b8de4715d8195624da3deca3b0049d5161e3e699df3d02c488
- SSDEEP 786432:peWPpcdpFPbrZmcnQmPxhw5Cpm+L48MaoHDbwbnSN:peAp2PZvXZhw5km+5oHPwbn+
- TLSH
  T101673398B9CD0B8DC16D767D9A62A70221587B484C3BCC77C98907C9FEE94F6A5F3180
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  R4i-V4.3 Spanish/R4.dat
- Size 593KB
- SHA256 97ffa43008e49f55c6a7f65377b085f0db1c920740867d0a6ea278a196483eaa
- MD5 9fdbb11ae4bf60f9945ce9e6c9f12339
- SHA1 cd6ffa7a349a5de637599e96f7a30a93e1a3892a
- SHA512 a8ab4c3f2e9a7e6218452ace11ad3cc37249ccb13dbfd67ad838d2084c46858558f652b97429cd3812799a1d04e9679aa92a9cfa5f12f6941ac0b996ae33bc94
- SSDEEP 12288:vXGq5FLBYZ9rbZwpnuWQ2uw32D93pIYTjHIS5FtUYPryOdCd9:vXieQ96G5EUTK
- TLSH
  T152D46D4A78919A56C8D132BBFA6D51893B232774E1EB7107C934CB3CB77644A0E6FD80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 1/PBbutton.bmp
- Size 12KB
- SHA256 4a245873037ff640ae16fd27172ae8c246c066e205f7573058124d1200c71c40
- MD5 be4063e4e8c08f8b0fe45dce8b00cc4b
- SHA1 6613d095ec90e8aeccc35a54c1d31caa226d4c67
- SHA512 f36ed66f920968ea9d87fd558a12014a433e0bedec6937614376a82e105820a5f522e921136f82a038d8a2399c3ffc1b61d050b54fa59ee3aa2b4f9f6f8d5928
- SSDEEP 48:PavMSjQ8dEIkJ4PnRyJn3E2pIRUkHiKCpZif2:yvMSjQGE1JenRyJ3H3/xpH
- TLSH
  T14642A9B8E9333603DFA4F97D4521BEB99DB80491EA01E0D77892D2D16DB14E61D43327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 1/TGbutton.bmp
- Size 12KB
- SHA256 2c3ae2b96ac7b0710ddab6a62a6e0dc05c7d5346441cbf0382cd654ffb0b6778
- MD5 c8ef3583394276940412302cfe6497ea
- SHA1 dcf0d3a4b256964ed153e0f21420f3145dc31b38
- SHA512 b51aad5741c0665dddd3f96820c4af384be8842073d4ead27e2693621e04d91ef675ccaf1c69ec700fc249c5595812e7d8cb3ae29b3a56e49365531053f79ed9
- SSDEEP 48:PZWvOVSwmBQ8dEIkJ4PnRyJn3EBp3twvtkHiKCpZif2:BrVSwQQGE1JenRyJ3wdG/xpH
- TLSH
  T12042C7B8DD333603EFA8F97D4521BE7A8DB404A1EA01E0D77852D6D26DB18E61D43326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 2/PBbutton.bmp
- Size 12KB
- SHA256 063fec5816f3216fec6e58f1d2c3c2398a32c1209de043c2a7cee13b90a919b0
- MD5 c99625c1be38474cf3a4591bc2edb0b2
- SHA1 ba263503a00e83e86f5bf9b704aedeccf09fbc65
- SHA512 662a3f1edb9ac99ecc9cd111564a34cec282953b6f2cab7b438ae7d733a16c326f170f3f09caf41c39fa9184fcf356f21da844ddcdb359276a747787be59e05c
- SSDEEP 24:Ty+pPqUUUUXXyyTiNnRpWfpFGQrTLTTve/VpKX7Xi5A55lywxRB:e+JNnRp52zTOVU1RB
- TLSH
  T1B84272B5B4B461CEF2D6AF913F089191E6F7714456C1971C34078AB03B923093A4C7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 2/TGbutton.bmp
- Size 12KB
- SHA256 9deaacc577e7c566a1a2e99c7488be3edf868fbcda4bc65d1b6a1e02f7393909
- MD5 7d9ca012dec5f1e71a131068ed8d5d0f
- SHA1 d7600bf74cb9ff2177b9eb062a119d540166dd13
- SHA512 7e4113912e3b6abbabae7b012e17e4fb08988f24eaca804b7b4472aa19b613e4ad9c1acf5870b62be1f7d3c9fa8b2e57b8dc9be064e0539aabe0bfd15038aaba
- SSDEEP 24:Ty+pPqKmOjmmm/Fjmmm/Fjmmm/FjmmmyKmhyyTiNnRpWfpFGQrTf3b1gV/VpKX7p:e+hNnRp52SBVU1RB
- TLSH
  T1154272B5B4B461CFE6D6AF913F0894A1E2FB71445685D70C31078AB03B963183A4DBEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 3/PBbutton.bmp
- Size 12KB
- SHA256 fcb8b74254b593c8a7d96db30b37dd31aa0bad747c6b577d9d9ebb74fe7813b6
- MD5 3a783e8dd93c86da9b3be65d1d60cd79
- SHA1 e63a9eaaac98b1d6a266037580c2564277f50249
- SHA512 44a8327820006662dd0e3e46ed06ef9ef92431338ef485b8f5236dbcb43d27c68ee24b458b1056c27373e67918d74bbceda638d35533028cac52a30299b9b044
- SSDEEP 12:TfmgEuS9DkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkZkOYgG+FSn:TJE9Yeeeeeeeeeeeeeeeeeeeeeee2QEq
- TLSH
  T12C42CEF88972737AAB48D139CD0DDD187CDCA220785A45A4435E9EF34E3725418DE64F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 3/TGbutton.bmp
- Size 12KB
- SHA256 922d3b7068db8dc51eea56af01b797510afaf3cec88ba3adda5f45ed1e82f735
- MD5 0e893df52c172f7caf7628daf0ac1120
- SHA1 84706de7d327d1c21a5395bce5202f7d5cb6fe61
- SHA512 b92e1e86eeaf2b535291a3745dd189c2b13e27bbdb328c778f96430ec536d211fac69dc28bff6aa0650e5a7fbd482b20bc03f3524e37464bd71e7ef5517d48db
- SSDEEP 48:VEiYYYYYYeeeeeeeeeeeeeeeeeb3mmmL3mmmL3mmmL3mmmL3mmmL3mmmv:6iYYYYYYeeeeeeeeeeeeeeeeebooooo4
- TLSH
  T1464210F8897673BAA758E0798D4DDD197CDDA230385A0494835E8EF38E3764408DE29F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 4/PBbutton.bmp
- Size 12KB
- SHA256 628bbe7d568cf924199bb2dc26611c71e7055c3a7e9b413073bc59fa5336911c
- MD5 b0333141425399dc19d98bd238889496
- SHA1 e895276f98113709a0f00f8c446384420809794e
- SHA512 abea05154c422a2f4977fcb3a711e6995770f254ca80a168cc3c7171f84ea96209b7d2eafbf8cf0681e669c6881e25bf95cb07a72240a1d433a5513f76c891eb
- SSDEEP 48:XKh+WZX9wi1dBgMwEJGi0+HmwkehJLskaf:qjZX9wi1dBAi0qlkeJok+
- TLSH
  T1DC42C5D4DC6D80DEF33FD21CA510F1E85260B4A1AB1FB26BB071DA706973B920A61D6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  R4i-V4.3 Spanish/R4iMenu/ButtonLiB/Default 4/TGbutton.bmp
- Size 12KB
- SHA256 083bd8d1c125e357ffeeaa2a59920494ae2498325669993aad5d17ed0941d635
- MD5 530e7b85adca638d7008aa95a9301ec2
- SHA1 5f540c5556c7fcca0bd2b5d53a9a4f2821209ec6
- SHA512 52a3b3fceb65bcfff565b7ea8b2360b04aaf1f7a800acd07ddb961e0f4e190521c66da56467c65e5492f7f410985605a2bbe93ecf2a9dab1b7181286217f1d75
- SSDEEP 48:XKDocO4ZX9wi1dBgMwEJGRi0+HmwkehJLskaf:Ioc1ZX9wi1dBYi0qlkeJok+
- TLSH
  T11D42F798DC7D40CEF33EE15DA550F1E86260B4A1AB1FB25BB131DA706973B930A61C6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  R4i-V4.3 Spanish/R4iMenu/Demonrst.dat
- Size 68KB
- SHA256 a35a6561b279220679ae3b87980314f4dbbc8cc2488282489511a8482d173fb9
- MD5 38d9e858986611003cf72fa2db1de2b8
- SHA1 1502b573cd35514337b95f5d0dbaf8453ca47967
- SHA512 0dcdbc53c76a5d58802a5a88c71aaa755c22250dff14b74128f3d1068c2e6fe5e1f85dcd07ceaff812e00582b3732f32adb64e78c11be8ed7068fef1c431ca86
- SSDEEP 1536:kYEZweYRu+PXosb3pr5AylfXRtvvUWVcYI+VF3:AZwK0XL1AUVkq
- TLSH
  T1E0632B4771409B5EC59C227AFE1DD1B53F230FECE1EB72019E183B686B7A5124E5A903
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  R4i-V4.3 Spanish/R4iMenu/GAMEINFO.dat
- Size 762KB
- SHA256 cb2639279436046a2f95927b680527bf6a3c6ec27ef26c4c675dcc1f9641f562
- MD5 6a9a6eeda68364dd2486248be7f2df16
- SHA1 a37764d377d16ddd1a2a032220aaa156b3fff1c0
- SHA512 e46fa8b1440d60280fc02b684b605c80ecb09d88399d118a82f1103416e520daf8594ff3516cd0c58a6e6517e1552eba2992792ae6816fc8076150993c6507ad
- SSDEEP 3072:T9lR0AvorC/l8xbgm+BnQVVTbpG+DgblLZLKrkOUTYBxbrq0R7bnxqdTDl6Ur9QA:pkayxsfBngdQZKd8zDZpsapG4j
- TLSH
  T132F4DE4B3A84E492C19620385CE2D2CBA3733D62DD6C18D7B8C6B31FA476D77CA3A455
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  R4i-V4.3 Spanish/R4iMenu/R4I.SAV
- Size 37KB
- SHA256 e73ab3cc6f427a9b577f516a37cd6a67ef43fa6103702821e913834a00470b60
- MD5 9fe8d0e37c553eceae96498b975eed45
- SHA1 dfd32cd06dc08ee40d5dd348a93b2fc5c73b7306
- SHA512 2c8fa1148dbf0fbfde30c3da60e560ffd83dce58821472f1f7bb0ed490df1d3a1d2218cf2f04f457d2c42b6add60c22f197e2ddd0221bdbbf4bb9256eb25ef1b
- SSDEEP 3:q/b:A
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  R4i-V4.3 Spanish/R4iMenu/R4iLoader.dat
- Size 143KB
- SHA256 dace43033a33fc07fd9c1efc8a8afbe41b69b8d687bbffeb8fc8457f2ded307a
- MD5 05e1a484ad8c732865c43ecac7630241
- SHA1 2c15de35361c78dc553277af3db8e9822ebb3930
- SHA512 692a01d94ec50aac96402e2e255217960524330e1e021be1bb221c370f0c7f353abad3c28c43be5f719776bbd373137e8435bc8b2f81e44e68b510e0618e23cf
- SSDEEP 3072:kJS4IFSMWPHYrEuH0fY7IVJFo9UnKmi0:3Ofju6YEtKmi
- TLSH
  T148E36B46B8C1AF43C9D0277A756C428933237F38E2EBF3439A266F70A7876951F66540
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  R4i-V4.3 Spanish/R4iMenu/RTS/Icon_16_16_RTS.bmp
- Size 1KB
- SHA256 1780e58cb664f8813e6f04f42e41d1ed6880d062134d0b4238c18e935dd747a8
- MD5 c6be9a0b92497c35bf1ec64c8899ed3a
- SHA1 9d6d3e8549816c6f793f920dd74811061c0af079
- SHA512 f18a19a46516ba1ad541c3bcc3855fdf5cfcf62fc626adacaa0dd07792ff95681b2b412d662027d8305dffcdaf4a2847f997c6ceee7f1d4169c1631332749e29
- TLSH
  T1A23127136C41AB0ACDA18D72FCA056FC63764EAEECF21987727E7E46B075169048F103
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  R4i-V4.3 Spanish/R4iMenu/RTS/data1.bin
- Size 188KB
- SHA256 f861abc10a0f3016ef659345cd770e4aa3c351799b0fcc5e62d872551739aae9
- MD5 a4fd0259eabb379ff9c160140caff0f2
- SHA1 8a6dd256e9e1b1d850b0db35dcd232ea9072fe9c
- SHA512 dd6f5183b476aa41705f3d84dc09ea836aeb1a8a10a8c8ffbdac297936f2793e00062cd0505a5bb478106d83f7c8846cea20a87759374a30a8787fbedca2d665
- SSDEEP 1536:dPOsG6tzNTtm0UeJfIptB44DX46v6CGYkZ9yYpu+PXosb3pr5AylfXRtvvUWVcYP:5OsGcz1BUGfEtPd36Z9u0XL1AUVkq
- TLSH
  T15414BF2776509B4EC59C26BAFE1CD0743F231FDCE2E676128E183B685F796024E46943
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32