Rizonememorybooster.zip
- SHA256 ce87f7c2082875b01904eb27d7aea95bc90355bcb399193b8cc03dc65450426f
Behavioral task
behavioral1
Sample
memBoost-1-7-9-1798/Readme.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
memBoost-1-7-9-1798/Readme.rtf
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
memBoost-1-7-9-1798/Support/memBoost.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
memBoost-1-7-9-1798/Support/memBoost.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
memBoost-1-7-9-1798/memBoost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Rizonememorybooster.zip
- Size 556KB
- Sample260713-afrfrah13p
- SHA256 ce87f7c2082875b01904eb27d7aea95bc90355bcb399193b8cc03dc65450426f
- MD5 c787d19e83addc594a07bec8bf6d546f
- SHA1 1b489d8ed05391a15647519a9ae9df03db2c2bd7
- SHA512 0382aca73e5eb4a64b8c6d026fac1b9102b2ce29081d86dff4c369e574cf576896083ff5c96eda75bf1b89c677a3bcac4e0f98f29bfd7f2c9eaa1313924c6c1e
- SSDEEP 12288:lPXkfDzqM4CzSQlxlwg4cRZBwNv+2wOuHavpmP/seDxwJqMTti:lv2zYCzTflwg4w422nu6v0seaTc
- TLSH T199C423285C492906CE5B69D0B89C736428D87F642BB97425DE3913A104F90AB82F7E7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/memBoost-1-7-9-1798/memBoost.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/memBoost-1-7-9-1798/memBoost.exe unpack002/out.upx
File Explorer
-
Rizonememorybooster.zip.zip 556KB
-
memBoost-1-7-9-1798/Readme.rtf.rtf 79KB
-
memBoost-1-7-9-1798/Support/memBoost.chm.chm 80KB
-
memBoost-1-7-9-1798/memBoost.exe.exe 523KB
-
out.upx.exe 757KB
-
memBoost-1-7-9-1798/memBoostl.ini195B
memBoost-1-7-9-1798/Readme.rtf
- SHA256 80aee4294cccd3190a020c34c252f57a7f771b3626b0847b69cfecc19a0d48d3
- MD5 bec23dec858a041a83a2ce6ab5b9748c
- SHA1 b5a1c4f534bf59947f5fad747bd07c0c4d4dc2bf
- SHA512 ededbb326b0a137bffd487f8953e40d001dda8ab0204ed66e909c46cbd6a92767181ee1b21dbf8546ae98d6777b60e3fc1760fcacc8a2eb08b251b2cb19141fd
- SSDEEP 768:lEcqa3HUzX0TleviG/aV5qpt2LlG6sjyxMaPMc5x3bxbnlXWFiG/aV5qpAuL1KSg:lEpa/kDreB
- TLSH T1098364B805428391D2724784FA5EF0CA6E35F11418E578D472EFC3BAA13FD2EEE54962
- MD5 SHA1 SHA512 SSDEEP TLSH
memBoost-1-7-9-1798/Support/memBoost.chm
- SHA256 b399a5dd2b017782a0c161fc097e891e9b7b1ba5cb4a3961e2277eadf842fd8d
- MD5 f39096214060cba8f13b32eac7616800
- SHA1 38768c95d88b42f55b40027e45da60ea72c45aeb
- SHA512 756cc761d8c3fa49313ba7f1248a46a452dce9e209e28b658860eb79d11820f9463171fcc2916adb824d414bad2e875ab4e26bdffeb8d710bbf832fddfca8a4d
- SSDEEP 1536:1fLOk4s01Pc3peCVanemdnAIdOgoSThmQ9+vpw7gK/CCFbB6M:hLN4s01P6petnTFddOzSThH57rPP
- TLSH T126830262D6F82301F94E07F03CEAD969D3B45E224524AEB7381B269C15F59194EF1CB3
- MD5 SHA1 SHA512 SSDEEP TLSH
memBoost-1-7-9-1798/memBoost.exe
- SHA256 7b618135fe7f7140c3c100ef3fdc3c0562746097ebc20e640751d3b7e3561626
- MD5 db2dbaaef2e345640704f7b7880bb89e
- SHA1 090d0dab7e4d59e4bb68f31d5d638cdbc9e82daa
- SHA512 bb2ccbc2cbcf74974db58a8a77f045219335839dd17a53c5504a49659286f3f8d0a78921aadfd3c18545cede32362330554461cca3be03aa241fcc50c0fac365
- SSDEEP 12288:0zcRD02J4Sq2vHGB67KWKKmDXJFDmv+swMoHaLpmP/se6xK:ecRToImoAbrDm2sDo6L0se7
- TLSH T1ACB4125AC6F2BB1AC6255BF02A97B73225BCAE5153264706D2B07C754FFD2C33D86802
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
877264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
576KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
277KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
67KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 9dd9b6e5faae96f40900ebcc259d413d27843e0d9f6efde28d5d5233a18a7135
- MD5 3f13f01f21490edd08c62a2a5e3027a1
- SHA1 973aa4b9460a2e7724a4264672e83e64bc2beeb0
- SHA512 dd5e7c3dcbc0f6ea9e6b98de765b68c5a6597698e2bf7fe50d0cbea28af499ba2d6cba8a838e83e4be87b08ebe476563f63c8daf1176a13d2751d18f66c94477
- SSDEEP 12288:3kxDoouVA2nxKkh0vdRgQriDJOIZW+yBGQowlNCh:hRmJkqoQrilOIQ+yMx9
- TLSH T178F46B2175E39025C1A212F24DFBF35D552E5E27031ABDD723E0FBE88AA41D13919EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
memBoost-1-7-9-1798/memBoostl.ini
- SHA256 3f1813e1b2d5ae881dc8ac02fad5fa8768508e3f65006e5ae81ce48fc3df1b17
- MD5 24a89306902aecab2f89aaaf194cb8b9
- SHA1 5f415a395671992905273a3e2a362ec20e47aca7
- SHA512 fc4e7d8325fa84c077617799c0865c8d302a2ba518dc7d23da9061af35a4bf5c216f38348fcbe1c9d455e908faecd4b7b352422c7fe44a466fbc2964ed7980cb
- TLSH T1F8D012F9DD80464D116AA0765C62538587A10844845B853015E6554ABE4560FB36B182
- MD5 SHA1 SHA512 TLSH