d3e9915e661c999c10967357db62e659476fbe579b5b50baed68a780899e98e0

General

Target
R6R Release.rar
Size 82.7MB
Sample260804-3tphjatbqa
SHA256 d3e9915e661c999c10967357db62e659476fbe579b5b50baed68a780899e98e0
MD5 90d174f69e71582ab2a232f9ec791b26
SHA1 6297fdc809716e8fa986cee5218586c04b591509
SHA512 3efdabebb5ff75ba2db5cc6c6e171223230407aa5b877b192248c2a58e67bd2971e51dcfc43b5ec82d151539c37bb655a39bda86187862fe042e9570b79262cd
SSDEEP 1572864:welH6/c1Uvj3Of7LqFdzLcBdyNyBnrO+U1deWz1R:weN6/iPqFdncBdyN0OTPzD
TLSH
T13D1833A94471292FC1B9D839D997DDA686C33CEC2F519A43A76A79373A770046F3230C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  R6R Release.rar
- Size 82.7MB
- SHA256 d3e9915e661c999c10967357db62e659476fbe579b5b50baed68a780899e98e0
- MD5 90d174f69e71582ab2a232f9ec791b26
- SHA1 6297fdc809716e8fa986cee5218586c04b591509
- SHA512 3efdabebb5ff75ba2db5cc6c6e171223230407aa5b877b192248c2a58e67bd2971e51dcfc43b5ec82d151539c37bb655a39bda86187862fe042e9570b79262cd
- SSDEEP 1572864:welH6/c1Uvj3Of7LqFdzLcBdyNyBnrO+U1deWz1R:weN6/iPqFdncBdyN0OTPzD
- TLSH
  T13D1833A94471292FC1B9D839D997DDA686C33CEC2F519A43A76A79373A770046F3230C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  ORS Driver Loader.exe
- Size 238KB
- SHA256 fcb6f441707264fca2305c3d7b596a5a87e81331bac43946b6e7606ea99d7fac
- MD5 7ba37d9f239d9ad83dd2b993fd59fbe3
- SHA1 e479011a9d96585128b231c08acb52d90e529baf
- SHA512 0600465c1dc2aa3d5778dc8bae66f8b4facaffdc4dbc60c090c7031358cde40fbf02a0c96ec66a66002f0b7c188642d8ba45b3eae9525a15046a8cbf5e29db20
- SSDEEP 6144:G4KzBEAqe2E061jxVa3SsJ6aOQApPemG9gB1N:GpfsJ6aos9M
- TLSH
  T133344B16D7A510BEE1779A78CE624842FF727C4547A4A6DF13900DF60E72AE09F3A702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
behavioral2
- Target
  ORS Setup 1.0.0.exe
- Size 82.6MB
- SHA256 d23185fc62d599921279db4b75aebd29dad6b53cbfc3e2b9dc6c28ba3173a7cc
- MD5 1176a9a1cb39a44e4e7ab8a32b05be43
- SHA1 a94924f9302b69881fb77749722ad3013ffc04b2
- SHA512 7ad9dd980a41c65444bc12260528743c482ed93dddc9fd6f5622f0c2dbf6d371830789a2333f872395712a9e3eb44600a08e0c45a57d1dcf58f79786ba47d4f9
- SSDEEP 1572864:7elH6/c1Uvj3Of7LqFdzLcBdyNyBnrO+U1deWz1P:7eN6/iPqFdncBdyN0OTPzF
- TLSH
  T12E1833A94571292FC1B9D839D997DDA686C338EC2F119A43E76A79373A770046F3230C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral3
- Target
  $PLUGINSDIR/app-64.7z
- Size 81.9MB
- SHA256 bde4942de8c0025a340f8ba9b79972811561f22461cd3fa112599c54d0a9ffa5
- MD5 452c547ec0798e7fab7f04d875139cb9
- SHA1 a34ae2e91da833b42fc958d75b65ece8c7d0d7de
- SHA512 4401c51d5f9b6f5e803ca0724146cfd21960e5960e9f2bf96a9f519fea8a716020244db414303d74645fb39aadb5b7d13e7e8eca4e7458629d35406bd05069f2
- SSDEEP 1572864:TlH6/c1Uvj3Of7LqFdzLcBdyNyBnrO+U1deWz10:TN6/iPqFdncBdyN0OTPzS
- TLSH
  T1FA1833A94471292FC1BDD839D997DDA586C338EC2F519A87A76B39373A770046E3230C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral4