9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a

Sharing

Copy URL Twitter E-mail

General

Target
Risxn.rar
Size 3.2MB
Sample260727-ycqxtach95
SHA256 9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a
MD5 5885c2e476a34bb8ccc0c4dcdb743b4b
SHA1 346232b4d13083db4985ed0dc97d6899e995cca7
SHA512 0765debcc565db5ae4ba5da896046a484397c2951634798b86de8ae4f801ba019f198fa04725dc6cc6dd27eb595ae516dd731e810c7abf2158ba617587bbdf5f
SSDEEP 98304:HlRFl0gOy1qGiD3BtRnl0gOc0UTuO26x/Qr:HlD2GWbRzmn6x/W
TLSH
T1E2F533AFAC216EC25511231BDFB71E037293DEDFC65F5A95CB3C58046BD882D2A09B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Risxn/Risxn/Extreme.bat
- Size 67B
- SHA256 daa60fee66064274789bb06c041c36b0bdd78b30f47839cea0283962acb1e0e2
- MD5 7a782b267e5a169101c321366f2fd132
- SHA1 f1e7707fa752a256ae03a855b61324be6fceb881
- SHA512 deab869183684dc8d5dcdabc22e85ba18e85859d61721496ad1f37c605141b10c91b5fc971d650bebb8ce995eb2c5d7dc18f4505e650e8f5261f76941f160caf
- TLSH
  T1C3A00211CD1180926ABA0840139A3955794E9487F5405DB534A714BE3CCF54D14883D6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Risxn/Risxn/Risxn.bat
- Size 63B
- SHA256 de4437bb85ad76f7b113172bc4963bf334ab3f1c8245b26ec81ce16d7ed1bb71
- MD5 0feda21801b6630b109a3723071732db
- SHA1 d2a04eb3e707505ccb1ce388cbf065e4dbc84c46
- SHA512 bf4dc5dcf75736154625c3a72ce637dc0cbb45f8528c79cf48e6f2872f882f708c7921e1213d3876dc3433154d255e138075e4b49e895263a994a55322c1e434
- TLSH
  T18FA002298C3641D1BEA35A00156E3F59B94E94C7F5405D5424E2252F1D8F54A149C0C1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Risxn/Risxn/extreme/0Harmony.dll
- Size 2.1MB
- SHA256 498ede1d20a87afaa6c7b1ed5b3beb505b01dc418b952c1be5c322204404b033
- MD5 ad6c335c09cf42975221a47b82268d14
- SHA1 76ce6a1276d99c27b3007bb4d9b543473f932531
- SHA512 35c2bb88852ddcdc8965e31590ff1194e0496973a87ea492208b08a6f68ed15ceee7e153c4e5bee4e084cf1ea594ad83055a255ad6b97e72f0d02dfcf09de6e1
- SSDEEP 24576:aDqxNcckUU2/LuBVKzW2jMDLL8QLpUch15R8rfsNU6Bmxgth:aPczUCQjZBXR4EN
- TLSH
  T145A56B85B7DE9E72C85E8F77E0A2010567B1D8879346DB2B15C0D27CBC8A34E5D623E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Risxn/Risxn/extreme/ExtremeInject.dll
- Size 17KB
- SHA256 32c92d98b97afbb450a71f2ce657e09bf9b23a4ac6a68688a6bbb7e1939efd0e
- MD5 f195aa8938a8dee450771c6f2711b967
- SHA1 557dcdc80f098175c5b05a6a9d651ee344e515d6
- SHA512 17fadbc36af1f181cc9668a6e519896ced8c1287d271bc539b8b384580416c3e6ce9201c4e46e9950adc0c8e640557b41cb54b6cfdc7e58a472a4f4c26657f11
- SSDEEP 384:RXPYyuyBK3aC/8UXh2ISkgpPv39seZyQC:RFEaC/8UX8n9sedC
- TLSH
  T1CE82E54477FE4604E5FE8A706CBA520A87B6F5579825DB4E0CC860EE1D377402A30BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Risxn/Risxn/extreme/ExtremeLaunch.exe
- Size 9KB
- SHA256 dc0284e74b805fde8862f9eaec2c1ce2d0b0dfe21a97b3c19dfc1b82635b6ec0
- MD5 5a361477eaad5e4fa238cc5a6b4e9ad2
- SHA1 dfccbdc0b6b4b662b138cb5e46e4bfbe4bf6e0cc
- SHA512 10f098b25da6ef755679eb6c3fa1df01f7287776f53a9ddd0a9d87d260b6c839086e64ee515fadf8fffa7ceb6c7dbde98f067a5b515c00ed1330524136215f9d
- SSDEEP 96:bMJCrsiQsNQSRlVCH0UcXga9kC+lV0qDnpan3fZGU2ROsMEdLMKFROPlwzRquDPv:wJ7iPnG0fga9p2ZNe8bpzFywtfwIK
- TLSH
  T13C12C505BBE90215FABB9736AEB791014B37BD538435C7BE244C690E5D33A444C91FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral10 behavioral9
- Target
  Risxn/Risxn/risxn/0Harmony.dll
- Size 2.5MB
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH
  T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Risxn/Risxn/risxn/RisxnHook.dll
- Size 8KB
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH
  T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Risxn/Risxn/risxn/RisxnInstaller.dll
- Size 1.1MB
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH
  T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Risxn/Risxn/risxn/RisxnInstaller.exe
- Size 149KB
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH
  T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Risxn/Risxn/risxn/RisxnLaunch.dll
- Size 8KB
- SHA256 212e9255d6be4f10bf291c956e04a57c8bec9959d9aa787038f1d049ce5116f1
- MD5 bdeb2b300c4b6e827815044020194281
- SHA1 3de4dfa377225e0b887da3c240991a9ad762933f
- SHA512 e14721e52d40c1bde37e0110c132f12060bd90e4ba416f578cce671202ad479427e11eaab434891521085a9fbece4d4ca9feeccabecafe4c89e38059a540037d
- SSDEEP 192:5ymTI/v92k43SYteky1T/r1gHRpL7+pLGc1PC:S/v8i3tliVSVlP
- TLSH
  T172F1A400B7F88361E9BE0B35BDB652104732BE568836C3BE4444690E5EB321888B1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Risxn/Risxn/risxn/RisxnLaunch.exe
- Size 148KB
- SHA256 4c466bb0909717ce39ee9d240c6a7e771fc8d459ac6ee73c9aa473b03bbd6aab
- MD5 bcdc8616fe29535ac64028a608aa039a
- SHA1 e9307e42d9427d64cb6995e9bb4eedd2faafc6d9
- SHA512 c27fc72e001866a58e2a97259ad072dc02f101eed3dfe5aa4b953f1a2f264c84c5f524ea7476491f6a964720a5b4241afc60ec0f2a71a72060d79f00570e3078
- SSDEEP 3072:RqeXA/4yIbHkNPN+6H6xCYOigUE265BJm:RvdHkNFdaxmMEhJ
- TLSH
  T125E33B07A2A851BEE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Risxn/Risxn/risxn/run/0Harmony.dll
- Size 2.5MB
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH
  T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Risxn/Risxn/risxn/run/RisxnHook.dll
- Size 8KB
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH
  T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.dll
- Size 1.1MB
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH
  T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Risxn/Risxn/risxn/run/RisxnInstaller.exe
- Size 149KB
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH
  T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30