1654f1f78d746fc87a6f6d078a8f928ea61c7b49997b1f2c07dfc870f8fa6c10

Sharing

Copy URL Twitter E-mail

General

Target
reaplugs236_x64-install.exe
Size 1.1MB
Sample260801-raxt1sbe82
SHA256 1654f1f78d746fc87a6f6d078a8f928ea61c7b49997b1f2c07dfc870f8fa6c10
MD5 5035be3cb0843c4e4267da0294ca6c22
SHA1 aff349dddb84833e4be2146de83507cf09633100
SHA512 633f4480be58db63553e96a38ae73252faef958d3d00bace408ee13a816ca0d1e4f606e6ecb965b2cb41d85d44cce7ca718d378bbb1cd79692bb1ae67b8c2d6c
SSDEEP 24576:aeD6G2yeNBACnrL+ZVa2ajmYKS7mJQbm7ZHK3Y:8G2yCACnN5jmZS7mJQS7ZHGY
TLSH
T1E145E0FAD614EC49EC0081F48E557D9AE951BD2056734B8A6E84BABCCEF14BD4F870C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  reaplugs236_x64-install.exe
- Size 1.1MB
- SHA256 1654f1f78d746fc87a6f6d078a8f928ea61c7b49997b1f2c07dfc870f8fa6c10
- MD5 5035be3cb0843c4e4267da0294ca6c22
- SHA1 aff349dddb84833e4be2146de83507cf09633100
- SHA512 633f4480be58db63553e96a38ae73252faef958d3d00bace408ee13a816ca0d1e4f606e6ecb965b2cb41d85d44cce7ca718d378bbb1cd79692bb1ae67b8c2d6c
- SSDEEP 24576:aeD6G2yeNBACnrL+ZVa2ajmYKS7mJQbm7ZHK3Y:8G2yCACnN5jmZS7mJQS7ZHGY
- TLSH
  T1E145E0FAD614EC49EC0081F48E557D9AE951BD2056734B8A6E84BABCCEF14BD4F870C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  JS/Effects/Liteon/deesser
- Size 15KB
- SHA256 f8b71b7047ec950137e6dd5db37a46f7bf22e35990ddd40a7f009f37b167cf64
- MD5 0d3c637deb96c3c98ec4952d8313fa1b
- SHA1 e8032513777c9c4e22a6237921ecaeec5d82088a
- SHA512 c125f91b7f80a6b8d8b620d500f93ffc53243e3dfb718d2481f2dbf01bf97edb1a8b3b9600ef5b0bcaa22e11fe9f9aaa6bbfd259ae0ddaea5c589072d0672a75
- SSDEEP 192:S3rt1xNXeVK3BTkkmYWscE/R59bBW/QrOwcvgFNm2mE9FsGFevg2i3m27FIK4E9o:8rNVigbcE559BWoXj959hFn9ShO7Q3b
- TLSH
  T16B721F4CDC316EF51A25F1AC6B4368C8F2CF0E9893658414DD6EEC939A1EB3A141EE53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  JS/Effects/Liteon/np1136peaklimiter
- Size 15KB
- SHA256 7173fa483039ef9643b218e64e5aa08f4a0fa51e297247b2c136d9ff7777133e
- MD5 97b388418a450bfe8065488e4f260ef0
- SHA1 1172b9dfa7579b0412c7ea2f4e1e3511c4b25b54
- SHA512 1cadf1b73cac263dd390d6f52816c912bf5e0dd6e937d0410bc66a7e7929b00533195f5def9b8b14c49793deaf697046ae818c3e483a959566ffcf077695d19d
- SSDEEP 192:S3rt1SjHaA3F9wEmP/JNcD88U6aSGS8LUsqTs+S8nMPbYvG6wK:8r+7PqcD88UVLUBS8nMPcvG6R
- TLSH
  T1DC6261429D56DB300460D67C9B03B6C0E68E48DAE3553178690DF0D66D4FB27867FE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  JS/Effects/Liteon/ringmodulator
- Size 9KB
- SHA256 959896464705de98169e1bf5b318cb9e82fd4551609eeb23292a0c9274c3b488
- MD5 804662819589f6e534d68d2351e0f621
- SHA1 4c0b42229d7838a1886c9b619c66dcf1ea173ebe
- SHA512 e845cf9a6413933b25bd8ff5bca90fab4f8de08d5d35af2aa9c9f1ed8cd29e1eb399612b75d9468e11a79c4044af4ac71da40b6d824edcb6261353fe401aa717
- SSDEEP 192:H3rt1MVUyTi0/gHDpsB+NIWD38bYd+Bq9kHsknjtn2xK:Xrg/kuB+NIWEzk9En
- TLSH
  T1BF1276470C098471C764EBFA8B2BC412C4EF14869B45138AFE3D1094E9A57A889BFB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  JS/Effects/midi/sequencer_megababy
- Size 119KB
- SHA256 79e256902397317eab3f7038e76e8cab9bece3c2f4eea77545eeb985152e789d
- MD5 abeb5f68972c387dac2917170287a349
- SHA1 1a1000d5d0ad7b5094398c6398eef9f32c05533e
- SHA512 babd965592c511fa9496e7429b1f5857ce68e170ab901a77758ba879432c9d17f905e351df91823fe04f5097a700d22abf6b7b5709e6731023d6cc3f3e231f96
- SSDEEP 1536:poCmo6dOeJjlke5wIy8ddFKi7wP6JHyIXKV:yCmgej/de+Q
- TLSH
  T1F5C3B35F4322168F49F38B2B4F45A185D1B8840B82425B9EFE5FA7C61FB0564D0BACE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5
- Target
  reacomp-standalone.dll
- Size 187KB
- SHA256 4c0862ab3cfd8a0345481b4792c07bf8d5a9761014f217d4e13669bf8143c7a0
- MD5 581a5155f3b494296c1a9981dcf15b23
- SHA1 403993d1243ae041351d8e24ed6d6397997c1604
- SHA512 f89992e8ec0e658d186990897d3a04e47b0a0a24a3a811aa43d39ad29169695ad824f866975ac7f4893bd822949b1b39f4962a403030c2d99c58594668b12c71
- SSDEEP 3072:CAfVIhsZb1k4hdhbOz5TTOTFoTazXW7ysDCWyNdMeV4IoV+GWtVQxKj1:CAf+sZb1k4huTqJoOzm7y5Wq4Io7x81
- TLSH
  T17B146A0272E504FADC72553489676A42F677384103749BBF07A08679EE3F7817A7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  reacontrolmidi-standalone.dll
- Size 242KB
- SHA256 0fb6cf94df57eca771efdcef76c2ca8ca24332fce64b71d2340f0b7faea1ed6e
- MD5 57aa3be37e2e4bbb5830883737c791b5
- SHA1 d76bdff4a77cd0cf1b70d8fe9b269d2f7a4125a0
- SHA512 8d615023555d7139ecb505755827115a996637476429703830b17658d7250fe6d7d5178fcb6a123fd9d52f9e53862ecf06914be532b48ac583d8436649d5908f
- SSDEEP 3072:d+QCm/qQRKRyp1AmIPLcsYzpgeHTZl7lW9C/LgWmZ9uWKUoY4XPtVFVVVVVVZG8j:d9L/qQbAz0pg0TZlhW9CTg/DJohfrdQ
- TLSH
  T15C345B0632958CF5EC6691398D97C586E77278100B70DBAF32A0836FDE6F7D06A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  readelay-standalone.dll
- Size 181KB
- SHA256 76df762bb1ed2a53e33a00c54eaabc209d5c4d482c55caa89f403832fca265a7
- MD5 9cd2aea517302968c8d47005817ecc9d
- SHA1 a9f192d1d9d98038219b96de83661b87126e5ce0
- SHA512 ff08ca8fd0e007a6b3770cd6acb42a0f772f5ed29045283eaecaeb4600da96f80a48609ca6d7bb01b8ebc2e20d8bf915791ec62920739413397f9a6f02a9cd6a
- SSDEEP 3072:OgqxwemVNfsSTErOe0tZOTTlDev+/vp2z5krqn0CqoHEO4IoVEuVVvq8XP:OxmVFsSTKTJavhzKrq0XWsIoe8X
- TLSH
  T181045B06729500FAD976913889A35A02FA77744147709ABF0394876EDF3F7C1BA3BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  reaeq-standalone.dll
- Size 290KB
- SHA256 c200e540c26ac793b43611aaceb4aa42cdd2829cdfbf0d60494716d9bdde8a7d
- MD5 4b87c6ed275ef63d9f4a298d4e92930f
- SHA1 d42ba9d4dffab640f3ec9257d5c8c2adb87be3a5
- SHA512 04e01fb3d60f9ce86143513653e16c519771b07745a3c7025348bc52c2f67b77ff3deede90c58db6a184836fe7c0ef73ad7bf13837855200566dce12d9e70349
- SSDEEP 6144:sEXAPB7aNCSdAI/a0BVrLtT+jv2gzY1ooSLZIo2oWq:/dBVBVvEBCDo
- TLSH
  T19F547D05B29518F4D173407C8AA7E657EBB238150734D6FF03908A2A6F37BD1AA7B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  reafir_standalone.dll
- Size 299KB
- SHA256 2c81826880d47a3fd0fe48ae37385c1945f1f109564588cf5a09491d01b3665e
- MD5 0dc05b6227c51a2b22733a6a5373c726
- SHA1 d9b7c551879e00442a55bc7f2cf1b2d6a2e268cb
- SHA512 2fa20955246c690f53efb876a4bcc3d6d8bc0327f31da8e5d3e9e13513843b490074bb323ba2092d66924b14de59f8e8e83ba5f405ee0e66b8a025f680a243d9
- SSDEEP 6144:4V7tIAbi/SbNRYtKtngT2YacTlNDzO/4MsMN2IoJbxBeqk:ingThaAGjoY
- TLSH
  T1D9645B45B29518F4E133903C8AE7A617EBB238540774C6FF07D0856A6E777809E7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  reagate-standalone.dll
- Size 176KB
- SHA256 36cde76c3dbd1d79275c5e52a7120c3ccb1e21ae144cfd5f0e70a0f939e29998
- MD5 1634980949d0747b5c2621b6152a009e
- SHA1 b3dbf37f0aa920a3269a4db7a3731851afecf340
- SHA512 8eff5c0ba387535dedaeb66dc2bd52b4b796c8df46e140738f8f7cbf1003f7e07bad1e66819ae45f4c399eaa68a43934373299cb57d885acb2d02c5d5f6e587f
- SSDEEP 3072:Fdc/xEh8MpEh527+qnpsETscuQqvzo3gnK3d1Of30S8VC4IoVwOXVGeRC:FdyU8Mpi27rTBu7zGgnKt+3fKIobEeRC
- TLSH
  T1FB045906739500FAD9769138C9A75A46F777380103749BBF079082799F2B781BE7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  reajs.dll
- Size 1019KB
- SHA256 600223acd0337c494a0bc2fb2a399f5ba477c6c0886e9c1e2c1f7475810fcf72
- MD5 3a39a88f58e3494835c08b0ed85353ab
- SHA1 21e701755be7d60df9e0382d2191f45ffaba104d
- SHA512 6d02da214a863af9c344d960207e256eb5bbf417e79240cb174756bcc6ba27274b2c838e9e73488b82c2bedfab85ce46995facf7d7a4eba2b4499dd6e044cbfa
- SSDEEP 12288:jwCdR3UeHXuS7/T5+4CaotGdjuce3WeY+Jca1Wh2uWWo/T2YRJVogaml:0CdRkJAfvRjucemeY+JcmzWUTDD
- TLSH
  T1B7258D45F29611F4C57780788AA6A627E77134151320DBEB4BC1DF6A2F23AE17E3B312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  reastream-standalone-12.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  reastream-standalone-16.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  reastream-standalone-24.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  reastream-standalone-32.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  reastream-standalone-4.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  reastream-standalone-8.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  reastream-standalone.dll
- Size 187KB
- SHA256 57c43a7a3f7fb7df14ccd7a4af77f9e475f98fe681486dcd290b23983099c5f6
- MD5 7d64c509d5eba82dc3f515fdd6346b90
- SHA1 0c3770f78ffb27c021a649c37378b993eae5f83b
- SHA512 3d62e4c68924c2b04e4084b4a2e18eed8bc20e54c7240e4236e0de8e1c6331a14e3e93fe7ef6bb6e39b7e9ca03fc498d7bb5afe6a15e5262b45b7b060e9aed5a
- SSDEEP 3072:qFKZln1s++7TThTI/uRXTCWocsFq9K0MCTYGiH9vavVFOI4IoVxoSTQj4Tg:iK/X+7TThT9OF+fMEYGWQ7cIoto
- TLSH
  T15E144A06729100F9DD7296348AA35A42F677740103749BFF07A08679EF2F7D1BA7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  reaxcomp-standalone.dll
- Size 296KB
- SHA256 a01e15b9a23eff54b8025d75edf44b26b9311e12de72a7c04cd0ca82752dbb70
- MD5 d9b5de0a5de1fa1bb4bf6a46c377d49c
- SHA1 36aa343c410c83ce6b41a41ede31f63d152ae858
- SHA512 bb43bdf3d59723f0bc218ab1601ec0f480bf9f1dcb1d10dafc8f3b47fe98d952adabaa888d76f7ecea607d3a954bc5f9f71dbb28f96754be91fb29fa0551dee5
- SSDEEP 6144:mqNvComP+VN+f8+OlfoubbTjCNzTNj1AgXIouoTwTf:3dfo6sF+o9wr
- TLSH
  T108547C06F29518F5D173817C8AA7D607EBB234111334D6FF07908A2A6E77BD09A7B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20