General
- Target Risxn.rar
- Size 3.2MB
- Sample260727-ydqnfa1sat
- SHA256 9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a
Malware Config
Targets
-
- Target Risxn.rar
- Size 3.2MB
- SHA256 9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/Extreme.bat
- Size 67B
- SHA256 daa60fee66064274789bb06c041c36b0bdd78b30f47839cea0283962acb1e0e2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/Risxn.bat
- Size 63B
- SHA256 de4437bb85ad76f7b113172bc4963bf334ab3f1c8245b26ec81ce16d7ed1bb71
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/extreme/0Harmony.dll
- Size 2.1MB
- SHA256 498ede1d20a87afaa6c7b1ed5b3beb505b01dc418b952c1be5c322204404b033
Score1/10 -
- Target Risxn/Risxn/extreme/ExtremeInject.dll
- Size 17KB
- SHA256 32c92d98b97afbb450a71f2ce657e09bf9b23a4ac6a68688a6bbb7e1939efd0e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/extreme/ExtremeLaunch.exe
- Size 9KB
- SHA256 dc0284e74b805fde8862f9eaec2c1ce2d0b0dfe21a97b3c19dfc1b82635b6ec0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/extreme/ExtremeLaunch.exe.config
- Size 174B
- SHA256 051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/extreme/last_install.txt
- Size 41B
- SHA256 455d11e46935ac8dacda17c7c1d437e93a7696d55cf16c7ba66fed70841a5b31
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/readme.txt
- Size 369B
- SHA256 acad4d851751a2284acd1999155402c5324d4143a91770f9f1d194e9ea361b79
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/risxn/0Harmony.dll
- Size 2.5MB
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Risxn/Risxn/risxn/RisxnHook.dll
- Size 8KB
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
Score1/10 -
- Target Risxn/Risxn/risxn/RisxnInstaller.deps.json
- Size 1KB
- SHA256 39853ad174f7ed41026c54a609eab8ec7a279b56092baeca634a3d8dce38d684
Score3/10 -
- Target Risxn/Risxn/risxn/RisxnInstaller.dll
- Size 1.1MB
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
Score1/10 -
- Target costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
Score1/10 -
- Target costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target newtonsoft.json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
Score1/10