c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d

Sharing

Copy URL Twitter E-mail

General

Target
Risxn's Process Lowering Pack V4.rar
Size 508KB
Sample260715-cb3dkab14x
SHA256 c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d
MD5 ce70aa1f6fa1cc0a14e079fc56b65970
SHA1 b58671b63bb764f285896a824f5020c314e651fa
SHA512 0034f6177a6af1305903d554a4611c8c7a0e77bb511ceb0b9cb3c767a2febc113ce372ac9643637ca4181cb124f7e99c02ddee6c472b9069b35f6869431263bf
SSDEEP 12288:MfYoh0Bs57nrMWRQKnjBF1Z04MZAbD/0aBrn6zwiGVd:MtKBQ7rdRQKnVF1Zffco
TLSH
T122B423D6673A1E183CEA36FB0CA3D66FA2519CC2DC5335770633917F2C0A4A5B06CA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Risxn's Process Lowering Pack V4.rar
- Size 508KB
- SHA256 c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d
- MD5 ce70aa1f6fa1cc0a14e079fc56b65970
- SHA1 b58671b63bb764f285896a824f5020c314e651fa
- SHA512 0034f6177a6af1305903d554a4611c8c7a0e77bb511ceb0b9cb3c767a2febc113ce372ac9643637ca4181cb124f7e99c02ddee6c472b9069b35f6869431263bf
- SSDEEP 12288:MfYoh0Bs57nrMWRQKnjBF1Z04MZAbD/0aBrn6zwiGVd:MtKBQ7rdRQKnVF1Zffco
- TLSH
  T122B423D6673A1E183CEA36FB0CA3D66FA2519CC2DC5335770633917F2C0A4A5B06CA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution persistence ransomware
- Disables service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  Risxn's Process Lowering Pack V4/1. Create Restore Point.lnk
- Size 1KB
- SHA256 7da557d87c51c2be1f288e1b6417544dc09a2b94a621a620766f87909f8aa846
- MD5 e4c1e94286aa3b57599db85366845b3e
- SHA1 6b23c7f52cd276c9004962cc28692765db699351
- SHA512 37032ff24f9bdf6c6fe6059007c1339aa83b84550e8d018aefdffd22929ea87db5e4e4615fb2b0726ce94af7b2b76f6e601cf4aba7984dd8a75125498e639247
- TLSH
  T15831E20617D81761D1F24A77407BEA62CA32BC6599B3DF9E01C051CC58F5204F875F67
- MD5 SHA1 SHA512 TLSH
Score

7^/10

ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  Risxn's Process Lowering Pack V4/2. System Configuration.lnk
- Size 1KB
- SHA256 cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38
- MD5 e602273d1838007a65f3f9cb356f48fe
- SHA1 580df21aefd12f983fddfb3768d8edc7457ee3a3
- SHA512 af661631d4c7205f2e7018c2cbed28481af65f424f8537353d4edecf5d371c8b70377ece530a9184925aa1c521c5b89ae56fbdbe0f9afeb0df24474ebf02f7a7
- TLSH
  T18B210D2B05C00B36C2B14E7784B7F3038F21FE26A8939EAE84C062C458A1516FC35E2F
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  Risxn's Process Lowering Pack V4/3. autoruns.exe
- Size 1.7MB
- SHA256 6111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb
- MD5 17bd13edd536269c417ba8e1b4534fbe
- SHA1 22470bb3a4c37a0c612ff7ad2596306065ac0c9b
- SHA512 00d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455
- SSDEEP 12288:5nhZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5b8:s0qQhMIX0e8uOR2xZnkiYWZk3
- TLSH
  T133854AE321DA842AC87D4530012486BE06FF6E7E5BE348DB92C77E2957704CD6E32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral7 behavioral8
- Target
  Risxn's Process Lowering Pack V4/4. Task Manager.lnk
- Size 1KB
- SHA256 76b86a761ad6bead54218a976266f99480363d2e3a336caea32cf1762f64f233
- MD5 562e8751e0f25e769d37cab0a584c13d
- SHA1 8e2265ef6021e631585931ae28e9248778e21a08
- SHA512 38cdbda9173e078eb157d96d8aa855238f80ddc575be51a42c1cc0be0bf5a96474673ea51a87650d6d42911158ef1125458abab63fffc6908b8f33f72e19b4f3
- TLSH
  T19021D00F06C51B66D2B64D7204E7E363C622F972B8939FAD018092C458B5615FC76E0F
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  Risxn's Process Lowering Pack V4/Risxn's Process Panel V4.bat
- Size 40KB
- SHA256 200a9e24e7e9c39c873eff0b7bd15c60490bb02c5ea0860236973c652eb768e3
- MD5 7899db7c201419854349144b176c91f4
- SHA1 75c22479d8d5c622b63384f04e5fd5d3597ee17f
- SHA512 cf085796f78f18362dbe0aa13d6a2d372654b8b823a09f94e72ad0d8c110aaa3aae18379fb45fe8a1dddba7820dc52723183643524f721cb4edc1efb7a10c5ae
- SSDEEP 384:IakElQKac+iDMlsB4VzTPc2P7fLz0DW13r7/4QfvLzdbndDDtF7z97zDDnLD91n4:zkElQKac+iDMmTDhL5bGgdQag9y
- TLSH
  T100039E267466FC178960F9D15CAF6A517F1403C3A900BBE171CD247CA66B38BE22F89D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral11 behavioral12
- Target
  Risxn's Process Lowering Pack V4/Use Restore Point.lnk
- Size 1KB
- SHA256 3a94fff9129bbce3a3cdec143d0eb553bf3324439c7dfc86f2ac6cd2335699b7
- MD5 65fa954249b8f103856be327ec9c54cc
- SHA1 12672dc7c72a2ce12cbfab727229519d862b291e
- SHA512 31aaa2bf50ac5d496b42d6ec2d443350aad594980ef089349d634688d4beae4472f4132ba7853282765835d6458f8a5f118456af561adb600504b2ec71981145
- TLSH
  T1CF21F30B66C42B62D3B14E720077F203972BB92AE993EFA941C453C81871205F835E5B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14