killmbr | a363978ae7330fc3de83d0eb941e5269d2b303d37139e3f06ab5574575255e56

Resubmissions

15/07/2026, 21:17

260715-z5g12sev4p10

15/07/2026, 21:13

260715-z2qtsaev2m10

Sharing

Copy URL Twitter E-mail

General

Target
RiftCat (Vridge) 2.7.0.zip
Size 52.7MB
Sample260715-z2qtsaev2m
SHA256 a363978ae7330fc3de83d0eb941e5269d2b303d37139e3f06ab5574575255e56
MD5 8cf29c1459d59e868241b856a0d13bf3
SHA1 c83e59ad117b727e180142a4c787c9304baa3401
SHA512 cea95137e9f35a0c4ff997a8581622f604537b0ae3e402d32c9b3400bfe417625f00401907944a4c37431ddae2e23425fe042c956a9bfa343f65cafef259a7aa
SSDEEP 786432:1H+jUNS+GyP8s2Ql5Gg01wM6dvuLlPmU3dKe7zlQes0Qgp2/Rkdf:1FXP8Ajy6dq1btRQg8y
TLSH
T123C7E024D794A716D5BBA334C1BC421AA231BE06F469CB4F70C9375C1872786AE11FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/VRE.Vridge.SharedUtils.dll
- Size 124KB
- SHA256 5da7c2728a3adbeb5ec4760b6c571a526eb3c23d6cb2fec3130cadee5abfd052
- MD5 f7c91edc0dcfc295bc38e8ff31a07c1a
- SHA1 c853ff7bfe1f836a2e9f3d66ffde49e319268f7f
- SHA512 375cebe39373c2b1f171f4abd44bb01c4dbfac188bc8d8f705fe087a9d9d2d909a44824d3a8d9a3534c8350049ac2ddfb39d9066ad8275af14455c9a8e0e2d5b
- SSDEEP 1536:dJxCfBuLkFdaKfgfZexrEsSj/gluaOMB/To4KpQ7ZmDp+zKMl2BAK3fic5:dzYBuTKfgdI/To4Ku7Ql+zY3
- TLSH
  T1BEC32A1463A88B2AD2EE4773E4B24C1C4BF1E64B6422EFEE4F14B4CD29457865513BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper
- Detects KillMBR
- Family: KillMBR
  KillMBR is a trojan that attempts to overwrite the Master Boot Record.
  wiper trojan killmbr
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/VRE.VridgeAPI.Client.PreviousVersions.dll
- Size 10KB
- SHA256 76e583c092d51ec88caf5acefe0edd33e0aa43b43933a75cab8f305b76d23d89
- MD5 6dec3be4c64e37bb43ec747c6b6a52de
- SHA1 775510ac3dec6e0c8cbf60788872ec025420219b
- SHA512 f4726aa2c2920ad76434311892e9f7acbcf5f6daf9efc96ea067b688f764b7e2edc65a894e221ebfc7dff97e194317c74cd9a42f9e9c48f93b4b4c907668fe0f
- SSDEEP 96:ULYYbo9atJ33BULUQoo5YBy5plE3gP8ekdKJZEwY3WSmVX4EHgUSrkEN9WNMIJK8:unBUQ+5Ec8eH6uSmXHrqTWbUp/aP6Q3
- TLSH
  T19E2297028FE44637C9BF177CFAE695159330A178E993C22FB70C980F2D825160E597B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/VRE.WebAPI.Contracts.dll
- Size 50KB
- SHA256 7a90e107d4d7c09d1f14f8d6001a7cb1765b70ef0a5221e7f539f6ec3364b142
- MD5 3e2f53d6ad1e94dac2486a6724e623a5
- SHA1 39b1498616e55b62ef51c311be9baa220fb7a3a5
- SHA512 9f34bb4003f9e9b5c8c4876f7e7652f7f1fb0ab8e19cd3c373ba8879f2a153f8d4bd9072eb61dd6ab86bfb8646078b44b4f454bd65b109c534408ab65f06e1dd
- SSDEEP 1536:xDBKl7zl/lk7crjHMHvMADCO87h1bnDQ/a15:23l/lkyjHRj
- TLSH
  T10A338525032CC37DCBC80575F13445AA02A6939A3221EBE5CFA0FC9F7A667991107AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/VRE.WebAPI.Proxy.dll
- Size 56KB
- SHA256 bda6093e8ca2c412212a97780c2df9f23214c2d0f46f24057da2c85ffdf2786f
- MD5 1ec9355529b7a196469e5dfb1529af09
- SHA1 f6fa295907fbdbaf0a06e68fd81d40f23cafa834
- SHA512 62cfd5481d33e533c25b1f7f0c85f10a7540686fb58cbec73a024f03430634a5562445fba5846b0f94b018f2f1fbbfb7ad5d9e8f308a050466181a4106a26d29
- SSDEEP 1536:W3IkBT/OUG7AaIjCC7wiR16TeU2sjLUBr4mSU+aupJ:WHgThoSHak
- TLSH
  T1FC43E94857ADCD23EAEF4F7DB4B142534672F6467912E35E48CC64F928A7382CA043A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/WPFLocalizeExtension.dll
- Size 69KB
- SHA256 274db912c3ef1cdd2b13758ddb1e63dc06ca787736b5735ae511bfcece0e1d01
- MD5 82e0cad5dd9bcf6a768e6f07ff64b801
- SHA1 11360b5c7151b55b827fbba0eaa4756be3b70658
- SHA512 d6d807e22fa9d87fc6541808fdb2350518f766f95f56f4e993406f12c74da244dae3087f905ca0c60b8a744b50ecc1bbfc99fbc36c60d1b5206ee3eaa8e4a3f7
- SSDEEP 1536:satBbXwfKGKOnOOGqKTHadefz8nu2AAMLZj519ly:3XwfYjbadc4ns3Lly
- TLSH
  T1FF634D3E27E88929C2FE4F79BC7141104B71D19AA523EB1D9EC492AD186779107C23FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/WindowsInput.dll
- Size 17KB
- SHA256 1634275e74e4ff1afee50fe15762c3b26ea53026fc67997dbcbbab992fd60591
- MD5 917da6cfbe8bfaaeb64ce9f4d0ed0f72
- SHA1 bac9744abca84b3d3346fca3f6178d09f7e1b6e9
- SHA512 5358d1d4d537376c9a36db4f352140952238f92fd737c3662e6ceba02821fd7e68fcf7b6e3f3cc4419bac6eb6a2675bfb4726f16db5015f84a022908d6bb2f7b
- SSDEEP 384:h34ClGhH4b/VF2EQkADI7hVe2/MBsxfsyHxwyOrGv4R:Be+Q3jB2f+KW
- TLSH
  T15D82F766ABEC4127E9BEAF3CA8F227056B34FC051973E71F121864E52E57BA00D60317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/XAMLMarkupExtensions.dll
- Size 27KB
- SHA256 a12b84e4088e06a17649747471c1445949e631f16731e019d0353cf879f66a26
- MD5 bcac6b4dc5bd2a75a446a9f2575bc3b1
- SHA1 96b67dba769a0b3db346cdf1bc4129c159ad835a
- SHA512 302ec2c1369a3e8573db3bf44436b0b6df32f74d040efd0f64e06525ea7f37261b9534c363f407fa940a71cfd5afad24a5d828cc4c7239ee61a65d99ada0330b
- SSDEEP 768:4wxlBuL83EvFfZnGCprWL3K3mNFfJX7t7ySXYIz1IEaqVTuA:4IlX3EtBnGCpCL3K3e7t7ySXYIz1IEaQ
- TLSH
  T1D6C21A0163688376CABE4B7DF8F4051483B1D358B432E795AE88F0EB5E537A50A907B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/protobuf-net.dll
- Size 241KB
- SHA256 f3abb1045f3c8a900127d4261b0becbc80475f5b18fd5986391ca87cc0b51c67
- MD5 5ab2559258696baba391ea03b84bae37
- SHA1 403cf67c9f823e1844be70e31e59cda9613e593b
- SHA512 6a975526b18ce9bfe190b1162fa98384ab25b69569dd4182bdf933cef872860364a29beec95872be6daf73b6edf8775bb40f3d473da07b8a2f241e6da5e01507
- SSDEEP 3072:yaqDnfWExP6AN9OZiDZ+qTNAqYRTO0S1Dg9agDdM5bOHEBUaZNNrq7CD/BPuiNyG:yac0LR+HYRK0S1DXO0ZUGNl/jBGm
- TLSH
  T1F3345D0077ED8B2AE9FE5675A870614197F2F81B751BEF4E5840E0FE5823B94CA007A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/sharpdx_direct3d11_1_effects_x64.dll
- Size 350KB
- SHA256 348cbf741bf59c360b2598574c10c71b4d9b40fecf48e96cb023fef26a2f9574
- MD5 9277d6a62d6a0e8e47c3e6a604e89a8c
- SHA1 0554f579c4e609023aeddfaff200d8fc12ae0eaa
- SHA512 a385393bc1ea618cca05c3e8568e53a8970b40427223b3c3258c60b326bd93b2cfab9a72ab5767fd5961752b808edf063235040000a11bbe1f132008f7a68c07
- SSDEEP 6144:CCq8eBDTLHitSpUWF7oqtnTawrJqSceW47Xx1367A:LdeB7idWqqteMLD7q
- TLSH
  T1E074E6CBF350ACD3D68A827C8AA74F49A37275680370D3DB1274035E2E6B7C15DB8A65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/sharpdx_direct3d11_1_effects_x86.dll
- Size 291KB
- SHA256 1478c20a4b9f57b4ac7feb1150ec2976b4735b1f25a455b3c722d6cb221d5a9d
- MD5 830db1f25a4d2b13668ffc7a7b7b7821
- SHA1 2c968750c2b2bd1a7644852e68194e795ed8210b
- SHA512 fec2cac4c86e972067ad572cbef25228ad9319add643b4cfba595990c53589385656e2a99975dde781ecc11b2fd4c22f872c4d3324ad4a621c6485ead9251013
- SSDEEP 6144:udNe8OCNTjBES0Ib6D4b3HlsmrS+Gv6k59:udNe8OCNTjj0Ib6DAHlsczSl
- TLSH
  T135544B51B781F8B0D9CF067D047DABA610EA66284B78E1D3EF150BCD0AF50C15BB8A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/x64/VRE.Vridge.CrossPlatform.dll
- Size 49KB
- SHA256 f78b269fa3d37344da7ffd1f66655b645423e7299b490179a0e6592f289f5c65
- MD5 5768d74985a0d434f30dd55d5f944571
- SHA1 cf6a0fa3cf7537cb994851da98a295f0ef36be07
- SHA512 fb67078176f449ad0cbf9271cd4cf52284bd26aefb97eb797e7ab360e1919c1097890340db6884ac07f87a1cabc2f332cb2d36cae090aa8b9375111b91d8e1ff
- SSDEEP 768:+esNdRHyJW6NaJzPjR5v/ji9ioX9jyaNR6no/BWoQSE68v7IO2nQ/0VMBIQ:Qz8Q6yzbXSByRngQT68vMO2nt
- TLSH
  T135337C96F3A810F5D567903DC6235A4BE2B271540324ABDF97A083662F23FD0673DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/x64/VRE.Vridge.Encoders.Nvenc.dll
- Size 66KB
- SHA256 006ebed0d85f1597f1326c86fcc1f8ff885a01167b65d62afebb2ac2e5735e4e
- MD5 1bf557ca8ba7dd1b4babb4eb36747524
- SHA1 71dbd1258e30da7a860363961e0aeeeff8decf47
- SHA512 8d2e2337b4459bd175aa03d32718ab683c402f9dc0ca478e7d7394a4ed14c1793cc415a89261faaceb13345a15aefdffe7438f7951e0a8e114564677c97aef94
- SSDEEP 1536:b3ddqHbkxDSIBiBW4QXVYZherbsdPWCrN1gBF7fvyr:bCHbStQUsdPWCrN2Bvy
- TLSH
  T11063A5EE67F5607CCC1B40B7E793D0246973B82A2320574FA0BA53791F728B66663B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/x64/VRE.Vridge.Encoders.Nvenc2020.dll
- Size 66KB
- SHA256 667fcb7f28d3481bbb9f4d7a1fc516cb183746d52c095260057e3e6c6edc72e8
- MD5 fa4cc9914809fce7cd0dc7ee521386c9
- SHA1 71f9bd47a2ffeff58eccf00609a67af73ef5ed8b
- SHA512 4a3408b03f07ddd62567b70b95697655e95a1a9fc1cdfb10afaa56102d35b1f3738b1cf151c2b4f003ee06c16ddd874e412e889ab304e07e1f0b1f02d9855d7f
- SSDEEP 768:9OxaxIHvGsECXsfnQC0X93+OtHeghlgLXg3aQDND4iixxvWcnKgrOF4/4TN1PFgH:SaiPGZvn6EkH9mc3aQD2tW3g/s1PFI
- TLSH
  T1B563281B3B6940A8D263D13DC6C35A52E376B8541B768FDF63808B2F1F223D15E36A61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lib/x86/VRE.Vridge.Encoders.Nvenc.dll
- Size 29KB
- SHA256 cbc688f493b6df91d290b2137a6aee0d20985dc378c2627df90795cd0e37df2a
- MD5 a05ea7ec98cdd0419e539473148d31c7
- SHA1 694e67e430596da2d9fbe0f5c3a2d05ac2ffae5e
- SHA512 3b2669fc15119afcf9adcaf1e82009a3f950c304cb16c177356a7a9dcee0c3a477ac74e37bb52eb8a935809cdab543a03823d75c2b56c5dfc6726ecce14efb27
- SSDEEP 768:h2S8161lWtcGaCs6EST4ocGKNXew2SdzJ3gkcGOyGKByh:rjC3mBSXhnKBC
- TLSH
  T1E4D2D542A9B0CC7BFBFC627439495D9E8C79B422BE804ED3335186998970DD7F27940A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/libenet.dylib
- Size 135KB
- SHA256 aa4d0162eed37ab74c77c1c4d308624443e3fb17c4b1ef7c66c7c3391b924c0a
- MD5 bdd263727f8617b7d7849baeef6c29a7
- SHA1 12a45b5f61f13574f7bd2d0672c0785c9c8f1933
- SHA512 a7570d00c8e8e722d2e0f86330ea7a155f646bc3556328e2ec224084371ad9e2b76d3626a9871f336fc4e343b9165bb764d143ce5f171b4a8e5eb0340ad83cbc
- SSDEEP 1536:F3AJ6Mtn4SnffqrzH7pePS6wnkTjEtonFuj1ULDX5IGrW9oH2:F3AJ6MDnffqrAXnFuj1UP5IGwoW
- TLSH
  T136D3F9B26336D11DC05BF47525478AF26600F7628420AB4743C8BE29BF76E2069E57EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/lt/RiftCat.resources.dll
- Size 52KB
- SHA256 b0fdcd232ab0caa3f62597584a9a26034d9356913a8bf71c49072bdf6e40e330
- MD5 9cef456158ae2bccba91158e82641341
- SHA1 6c8fb6ad935c95872e7eb32219be00a70f20c8e9
- SHA512 d6bf4c3d729f50e40315ff7215bef2710ad2129f445462ff707c25c487a75fa6ea369df93225a3d7d82bc0a43f11597db0b78ac538c70a88e07817e36bd37b27
- SSDEEP 768:UkpBl7B8bWF9/j7wmHvhXRRaTP9DP7MvNZTKkcxq8BfzE9BsaWyxD5m:UIMWF9/j7vhiTFDmT8fw9BPm
- TLSH
  T18F33715163F9229DFAF31FB5BE7D84548ABAFD1A6C12E42E1014424E5932E40CEA1F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  RiftCat (Vridge) 2.7.0/RiftCat 2.7.0 [Cracked]/nl/RiftCat.resources.dll
- Size 52KB
- SHA256 e31c662576a77ed0b306b97b0df73c58ead20fee8a3e1fcec5f27bda59d08456
- MD5 69c2e50c51d1a24e9d73934006867d9f
- SHA1 59fdac4a565b009720166428f5c35fde9a6ac0ba
- SHA512 27ebdca6a3736da77d7eb56b7d3b63c8fd3d86b9f8c7338a98445cf9899e91461ac288ad7a42b13d9fb3233760f8b6239759f955df66137337dbcf898ac853fa
- SSDEEP 768:qkpBCCTNR8EjTOWCHzh+XGuX+gdn2Rm7IXMNatbr/n:qI7CEjTPC42432RUlM/n
- TLSH
  T16633605267FD216CF5F31BB5BEBE91569B3AFE2E5911E06E1008810D0832E40CEA5B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects KillMBR

Family: KillMBR

Executes dropped EXE

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32