a0e87652a034ee588c704e143be0af5a591ce3076256fa512b50b05cd0751160

Sharing

Copy URL Twitter E-mail

General

Target
Risxn.zip
Size 3.9MB
Sample260724-2zae5avthz
SHA256 a0e87652a034ee588c704e143be0af5a591ce3076256fa512b50b05cd0751160
MD5 06858205ec11678ca87983f6168f4280
SHA1 af12b0eb5329c84651123546564d33db246be761
SHA512 06fc3e7b68d79e452d6e6744ea5b5af426cd3c373b0a3c8f47b5d4fb6f2c44e4a1863a47e3bb89c44167c95eb378af7855b1fdb73405f9c40e2ba5fa906f9417
SSDEEP 98304:n8dsi/+En0e1/wYhvVYI4o6fFrjG0e1/wYhvVYD4o6fFM:610eXZ479O0eXG479M
TLSH
T158163328FF14901E4DEF2D7B4A4C5F5678E92834EA0A1D038B2F441E7AD33558F89E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Risxn.zip
- Size 3.9MB
- SHA256 a0e87652a034ee588c704e143be0af5a591ce3076256fa512b50b05cd0751160
- MD5 06858205ec11678ca87983f6168f4280
- SHA1 af12b0eb5329c84651123546564d33db246be761
- SHA512 06fc3e7b68d79e452d6e6744ea5b5af426cd3c373b0a3c8f47b5d4fb6f2c44e4a1863a47e3bb89c44167c95eb378af7855b1fdb73405f9c40e2ba5fa906f9417
- SSDEEP 98304:n8dsi/+En0e1/wYhvVYI4o6fFrjG0e1/wYhvVYD4o6fFM:610eXZ479O0eXG479M
- TLSH
  T158163328FF14901E4DEF2D7B4A4C5F5678E92834EA0A1D038B2F441E7AD33558F89E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Risxn/Risxn/Extreme.bat
- Size 67B
- SHA256 daa60fee66064274789bb06c041c36b0bdd78b30f47839cea0283962acb1e0e2
- MD5 7a782b267e5a169101c321366f2fd132
- SHA1 f1e7707fa752a256ae03a855b61324be6fceb881
- SHA512 deab869183684dc8d5dcdabc22e85ba18e85859d61721496ad1f37c605141b10c91b5fc971d650bebb8ce995eb2c5d7dc18f4505e650e8f5261f76941f160caf
- TLSH
  T1C3A00211CD1180926ABA0840139A3955794E9487F5405DB534A714BE3CCF54D14883D6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Risxn/Risxn/Risxn.bat
- Size 63B
- SHA256 de4437bb85ad76f7b113172bc4963bf334ab3f1c8245b26ec81ce16d7ed1bb71
- MD5 0feda21801b6630b109a3723071732db
- SHA1 d2a04eb3e707505ccb1ce388cbf065e4dbc84c46
- SHA512 bf4dc5dcf75736154625c3a72ce637dc0cbb45f8528c79cf48e6f2872f882f708c7921e1213d3876dc3433154d255e138075e4b49e895263a994a55322c1e434
- TLSH
  T18FA002298C3641D1BEA35A00156E3F59B94E94C7F5405D5424E2252F1D8F54A149C0C1
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
- Loads dropped DLL
behavioral3
- Target
  Risxn/Risxn/extreme/0Harmony.dll
- Size 2.1MB
- SHA256 498ede1d20a87afaa6c7b1ed5b3beb505b01dc418b952c1be5c322204404b033
- MD5 ad6c335c09cf42975221a47b82268d14
- SHA1 76ce6a1276d99c27b3007bb4d9b543473f932531
- SHA512 35c2bb88852ddcdc8965e31590ff1194e0496973a87ea492208b08a6f68ed15ceee7e153c4e5bee4e084cf1ea594ad83055a255ad6b97e72f0d02dfcf09de6e1
- SSDEEP 24576:aDqxNcckUU2/LuBVKzW2jMDLL8QLpUch15R8rfsNU6Bmxgth:aPczUCQjZBXR4EN
- TLSH
  T145A56B85B7DE9E72C85E8F77E0A2010567B1D8879346DB2B15C0D27CBC8A34E5D623E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Risxn/Risxn/extreme/ExtremeInject.dll
- Size 17KB
- SHA256 32c92d98b97afbb450a71f2ce657e09bf9b23a4ac6a68688a6bbb7e1939efd0e
- MD5 f195aa8938a8dee450771c6f2711b967
- SHA1 557dcdc80f098175c5b05a6a9d651ee344e515d6
- SHA512 17fadbc36af1f181cc9668a6e519896ced8c1287d271bc539b8b384580416c3e6ce9201c4e46e9950adc0c8e640557b41cb54b6cfdc7e58a472a4f4c26657f11
- SSDEEP 384:RXPYyuyBK3aC/8UXh2ISkgpPv39seZyQC:RFEaC/8UX8n9sedC
- TLSH
  T1CE82E54477FE4604E5FE8A706CBA520A87B6F5579825DB4E0CC860EE1D377402A30BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Risxn/Risxn/extreme/ExtremeLaunch.exe
- Size 9KB
- SHA256 dc0284e74b805fde8862f9eaec2c1ce2d0b0dfe21a97b3c19dfc1b82635b6ec0
- MD5 5a361477eaad5e4fa238cc5a6b4e9ad2
- SHA1 dfccbdc0b6b4b662b138cb5e46e4bfbe4bf6e0cc
- SHA512 10f098b25da6ef755679eb6c3fa1df01f7287776f53a9ddd0a9d87d260b6c839086e64ee515fadf8fffa7ceb6c7dbde98f067a5b515c00ed1330524136215f9d
- SSDEEP 96:bMJCrsiQsNQSRlVCH0UcXga9kC+lV0qDnpan3fZGU2ROsMEdLMKFROPlwzRquDPv:wJ7iPnG0fga9p2ZNe8bpzFywtfwIK
- TLSH
  T13C12C505BBE90215FABB9736AEB791014B37BD538435C7BE244C690E5D33A444C91FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  Risxn/Risxn/extreme/ExtremeLaunch.exe.config
- Size 174B
- SHA256 051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
- MD5 2a2df45a07478a1c77d5834c21f3d7fd
- SHA1 f949e331f0d75ba38d33a072f74e2327c870d916
- SHA512 1a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7
- TLSH
  T101C08C1940E8BD278D328F27A352C926EBB0B2A6A064080CF02FA9670B3108D8247326
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7
- Target
  Risxn/Risxn/extreme/last_install.txt
- Size 41B
- SHA256 455d11e46935ac8dacda17c7c1d437e93a7696d55cf16c7ba66fed70841a5b31
- MD5 219408dbd09a446b7be5d7829d9dee56
- SHA1 07bb13e9bab81cf78e139d3bca95d37b77463fa8
- SHA512 3032ceff626e73889fc93abd690266695e692e6ae5d2927bb0f59e0c8e72516ef9f6f40cf1c05538b4d61d0bd5e95b0290f637e2464bcc51c4907b90c147297a
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral8
- Target
  Risxn/Risxn/readme.txt
- Size 356B
- SHA256 1271ebf64d106c853b362640d21ebaa2d3941f7d5e334c233c606976de8bd11f
- MD5 0ba539107f1564d65905fbabc6990036
- SHA1 c1a9a1cbd15dd9b4378248b2c03c817f3dbb85cc
- SHA512 8ee8f476df5f58d324e6241134bdcfc0aa467139dfcd044792ece85b8172c9ca7d694cfede40bd8686bd71aa38b27e8a7ae97f8ec6a0423d63a28ab5bd44f354
- TLSH
  T191E0204FC64450232FB53216D35F714EC34BCC579A8FC035B09E14116BF19934060779
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral9
- Target
  Risxn/Risxn/risxn/0Harmony.dll
- Size 2.5MB
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH
  T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Risxn/Risxn/risxn/RisxnHook.dll
- Size 8KB
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH
  T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Risxn/Risxn/risxn/RisxnInstaller.deps.json
- Size 1KB
- SHA256 39853ad174f7ed41026c54a609eab8ec7a279b56092baeca634a3d8dce38d684
- MD5 3bdc07a9a8dfcfede8b529fee9f5a807
- SHA1 b5d9ffb7a3e98d915ffcda0bd5505661a1f9cc50
- SHA512 9b3731cd9e0682bf4a4abbef3a8ccb256277ea66294fce0df81d925be1bb6a36bd146c3c9c1dfc0ed642f81bd6f007de7b3c6a0daa42baafc9367231ff36e9d1
- TLSH
  T134316B19D5A49D7709B52F6960394A41F722A33F9104199F7CFD20CC8FB2E6B6081F79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  Risxn/Risxn/risxn/RisxnInstaller.dll
- Size 1.1MB
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH
  T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH
  T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH
  T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  newtonsoft.json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Risxn/Risxn/risxn/RisxnInstaller.exe
- Size 149KB
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH
  T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Risxn/Risxn/risxn/RisxnInstaller.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  Risxn/Risxn/risxn/RisxnLaunch.deps.json
- Size 478B
- SHA256 daf43c349af50bb4ada8bf9eb7b970977ae955c7f959495c002aa947bd1c2290
- MD5 446dde9213480f44f31c9ad8ea844765
- SHA1 c43c25e62e8ed4d4fe918f5ca77b98e13b8cd69c
- SHA512 328b74711a349edad665e1eb89da5517612a8b79b3b4f2dd8b1a762113e47280f24ecf4db85600aa92fbaa088357f449cfeacafd4dcd0937328f97c9a06e6f2f
- TLSH
  T16DF0302DE5D80C9706F137F5693A4366F5B257731825280A7DFE841C0F7291B5420F79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  Risxn/Risxn/risxn/RisxnLaunch.dll
- Size 8KB
- SHA256 212e9255d6be4f10bf291c956e04a57c8bec9959d9aa787038f1d049ce5116f1
- MD5 bdeb2b300c4b6e827815044020194281
- SHA1 3de4dfa377225e0b887da3c240991a9ad762933f
- SHA512 e14721e52d40c1bde37e0110c132f12060bd90e4ba416f578cce671202ad479427e11eaab434891521085a9fbece4d4ca9feeccabecafe4c89e38059a540037d
- SSDEEP 192:5ymTI/v92k43SYteky1T/r1gHRpL7+pLGc1PC:S/v8i3tliVSVlP
- TLSH
  T172F1A400B7F88361E9BE0B35BDB652104732BE568836C3BE4444690E5EB321888B1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Risxn/Risxn/risxn/RisxnLaunch.exe
- Size 148KB
- SHA256 4c466bb0909717ce39ee9d240c6a7e771fc8d459ac6ee73c9aa473b03bbd6aab
- MD5 bcdc8616fe29535ac64028a608aa039a
- SHA1 e9307e42d9427d64cb6995e9bb4eedd2faafc6d9
- SHA512 c27fc72e001866a58e2a97259ad072dc02f101eed3dfe5aa4b953f1a2f264c84c5f524ea7476491f6a964720a5b4241afc60ec0f2a71a72060d79f00570e3078
- SSDEEP 3072:RqeXA/4yIbHkNPN+6H6xCYOigUE265BJm:RvdHkNFdaxmMEhJ
- TLSH
  T125E33B07A2A851BEE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral21
- Target
  Risxn/Risxn/risxn/RisxnLaunch.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  Risxn/Risxn/risxn/last_install.txt
- Size 40B
- SHA256 35df1d209bf22b8a3821b63019c1d405d3fd50cbe7a2230dedf5a3408b747906
- MD5 ec2ec44ef83c53e4697c7fd1c2752a35
- SHA1 c9a9270b3dc16dad861f8a5821c792b3ac88723e
- SHA512 80eed4b480ba185e53a30c9a149744ae0b53d259b87aafe40e66d070b5315a45371af309953e997e568d9844784f11ef97047538c6a93d86eedcf329ee6554db
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral23
- Target
  Risxn/Risxn/risxn/run/0Harmony.dll
- Size 2.5MB
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH
  T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Risxn/Risxn/risxn/run/RisxnHook.dll
- Size 8KB
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH
  T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.deps.json
- Size 1KB
- SHA256 39853ad174f7ed41026c54a609eab8ec7a279b56092baeca634a3d8dce38d684
- MD5 3bdc07a9a8dfcfede8b529fee9f5a807
- SHA1 b5d9ffb7a3e98d915ffcda0bd5505661a1f9cc50
- SHA512 9b3731cd9e0682bf4a4abbef3a8ccb256277ea66294fce0df81d925be1bb6a36bd146c3c9c1dfc0ed642f81bd6f007de7b3c6a0daa42baafc9367231ff36e9d1
- TLSH
  T134316B19D5A49D7709B52F6960394A41F722A33F9104199F7CFD20CC8FB2E6B6081F79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.dll
- Size 1.1MB
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH
  T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH
  T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH
  T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  newtonsoft.json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.exe
- Size 149KB
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH
  T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32