e7ad77bdd572c35d205034f871181c7b4d9a4110798131b60acd54cd44453947

Resubmissions

12/08/2026, 15:19

260812-sqkp3axyav7

12/08/2026, 15:13

260812-sl557sap8v7

Sharing

Copy URL Twitter E-mail

General

Target
reaper778_x64-install.exe
Size 16.3MB
Sample260812-sl557sap8v
SHA256 e7ad77bdd572c35d205034f871181c7b4d9a4110798131b60acd54cd44453947
MD5 0a38c1bf75d23a1b1c0285dd31774774
SHA1 dfaf76ca4931b42c7e5b89c934fbce2ff5722b0a
SHA512 05f42c8e9a815375adad90b5b39960a2e499715cd48629b913099ac102a634f2c0c549540e4e856935dab8cdec2450fb362d02b78b948f009e275cf43e2c2c77
SSDEEP 393216:HIBfywbkEDqHEz7A5KKws1gpGIMEWw2mMn6DMluSXT30:7sqHEvOKEgEEanNgSXTE
TLSH
T1C707337D86329D9CDC908DF6CC113E818F04FD6BD4AA192E5D95707E88BE4780B978CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  reaper778_x64-install.exe
- Size 16.3MB
- SHA256 e7ad77bdd572c35d205034f871181c7b4d9a4110798131b60acd54cd44453947
- MD5 0a38c1bf75d23a1b1c0285dd31774774
- SHA1 dfaf76ca4931b42c7e5b89c934fbce2ff5722b0a
- SHA512 05f42c8e9a815375adad90b5b39960a2e499715cd48629b913099ac102a634f2c0c549540e4e856935dab8cdec2450fb362d02b78b948f009e275cf43e2c2c77
- SSDEEP 393216:HIBfywbkEDqHEz7A5KKws1gpGIMEWw2mMn6DMluSXT30:7sqHEvOKEgEEanNgSXTE
- TLSH
  T1C707337D86329D9CDC908DF6CC113E818F04FD6BD4AA192E5D95707E88BE4780B978CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $COMMONFILES64/Propellerhead Software/ReWire/ReWire.dll
- Size 2.1MB
- SHA256 08bd9c37ae6f38ee4410b8a5dcab992eb2082ef5845c2cc5dda9bfa88a086831
- MD5 3f7d6398717d9bc8bd9116aeadc5234e
- SHA1 a487aec494e27567c1e8dd4c794188547873a001
- SHA512 b1b01cf1a952d40df897b3eb699986d735ec93e76a4cb4ce4a1e59b1526040cfdff827117c34f95c935a1687d4d9ed8390e26e27a518340815a5b9a43ec95c0e
- SSDEEP 24576:/vluOWI/TLARZeFJ5kOnPpvJmS52vhahB7RtZid19MiyeFiAV:/vlUIugF7HtJmS5cqtZ019MiyeFiA
- TLSH
  T17CA5D71ABA28C221D177D0BFD5C39E8DE97230415B305ECB155A8BAE1E377DA843A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $INSTDIR$_8_/Effects/Liteon/deesser
- Size 15KB
- SHA256 3e822ce973a47bcf37f59f4227d6651089f0733ebbf7b630f26fd6547a63b687
- MD5 0f1c9b808f72e17015fe643ad9fbbac9
- SHA1 4326c0fc4b0fa309a23655a2c07e13bbfdb10fa1
- SHA512 6f57a5238b22ab41f04a2452f9184932680fc26dc4ee5892e812213629d7f2dce30c8e0abb361bbabd507c33c990815e6bf258c807cbd400ae17350ea1db72ff
- SSDEEP 384:8rNViUpNbcE559BWoXj959hFn9ShO7Q3b:8rNoUpH5hfRa
- TLSH
  T190721F4CDC316EF51A25F1AC6B4368C8F2CF0E9893658414DD6EEC939B1EB2A141EE53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  $INSTDIR$_8_/Effects/Liteon/np1136peaklimiter
- Size 15KB
- SHA256 4aeb6fe6f8da9c7c8fb1d162a41fe1f53a459040a2a508f6ac5f69771d5a30c9
- MD5 683bb9cd691ed9be9d87c5135be312fb
- SHA1 4682295dee92d35a571159062d7dd3f706bbe6c8
- SHA512 b6f99a6b66f6769c4a89c3c61f313d0b089c280a81303e795fc26540ce5918391cf40abe9615308e60820f397536fb309b55c34275c8c221fe6de5af70386824
- SSDEEP 192:S3rt1SjHaA3F3+i1EmP/JNcD88U6aSGS8LU/qTs+S8nMPbYvG6wK:8r+71+iBcD88UVLUKS8nMPcvG6R
- TLSH
  T16F626042AD56DB300460D67C9B03B6C0E68E48EAA3553178694DF0DA6D4FB27863FE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  $INSTDIR$_8_/Effects/Liteon/ringmodulator
- Size 9KB
- SHA256 1a0e69a718654133a4dff2b5dc7854deb94e721100c7a906af7a9460a3b4229e
- MD5 86bcb8d15adae36a60aeb83a3cf85ba2
- SHA1 49db15967dfbc88ba3af076ba95c551f702be4d9
- SHA512 42da5e39d70362c16c1cdbfa7fe303a4d0086647b341f23cb60a7ac7a4cadce0ea60103d7aa3bb01f1c1884b3526e052af0768e88bb3b3a64d3f51453cb7877c
- SSDEEP 192:H3rt1MVUyTi2p+zgHDpsB+NIWD38bYd+Bq9kHsknjtn2xK:Xrap+zkuB+NIWEzk9En
- TLSH
  T1CD1287570C098471C764EBFA8B2BC412C5EF14868B45139BFE3D0094E9A57A889BFB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  $INSTDIR$_8_/Effects/midi/sequencer_megababy
- Size 120KB
- SHA256 e6ff7b22b0c7df3dfd67134977093f5a017b3c1a6951d7031b9ba1a38dbb1445
- MD5 17e0845f5eb78bcda5c9664c41f832c6
- SHA1 855ae479f875d7a175faef4368d4493aef8c6fd7
- SHA512 3ddfb49ecdf774952208c4a0559c06b91a509d2b9164f84ca0403faa563b42911c5ad24cfe43d6346c83b338c638e21017b0fad93adaa01e5862a6e73a9868c7
- SSDEEP 1536:ZoCEMNdOeJjlkj5wIy8ddFHm7wP6JHyIXKV:CCEFjj/dz+Q
- TLSH
  T1E7C3B35F4322168F49F28B2B4F45A185D1F8940B82425B9EFE5FA7C61FB0664D0BACD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  $INSTDIR$_8_/Scripts/Cockos/Default_6.0_theme_adjuster.lua
- Size 90KB
- SHA256 36282a28692fd179edeb7f47e9b45892a86e2a685ef7423692aa30bcb8584775
- MD5 c16fb932f65fd4bbdfd521170c2d830a
- SHA1 36538e1fcdc19959a3957a287f82e32a8b72352c
- SHA512 b397de034e4ed87e50b1a7b02d0a43cf9c5eb88d888cfba10dc9d16fd91841a91b54d0697affcf3e539594e1201838c89c10ad83ce9dad11dc611ed9e003a58f
- SSDEEP 1536:owUq183rloYlYqSbmfps5bOn97fohbOvbU11vRbxvJqYGwwCk1uZO3YPo:zUq18bloYlY7bmfps5bOn9UhbOvb6/vo
- TLSH
  T1F593180A74213370814795EF68473A07BBAA641326890571B4BD80D96FE4FB991FBFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $INSTDIR$_8_/Scripts/Cockos/Default_7.0_theme_adjuster.lua
- Size 251KB
- SHA256 7a5280852cfccc62adfe582acc95346a6ccc2489a1f798699a0d741846b0c610
- MD5 1b9ad84faa425ad85aa971a986eaf396
- SHA1 8d883727dc3007bd6e524e1bb41a5f48b05f07bd
- SHA512 486a31d8344e7354659f3bfb783b5faa26e34767bbc79b062c4285edc9b23146023cb373e960919f529d494198f0e0dbe3dad2cc5daab8fed245f25a8a157f0d
- SSDEEP 6144:p7D7Z7JKIH83b+wrHx5wJ8Bk1Tk3UH0jTuK3LF1T8wqrwK6q4DpHPJQFuVFFIArN:P7JKIcrRgNUF1TcwK6q4QF4FCpyj
- TLSH
  T17644C61B759233F06386D726D5174E19BB37209329022471FAAD19A0EFC4B2952FFF98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $INSTDIR$_8_/Scripts/Cockos/lyrics.lua
- Size 21KB
- SHA256 86d284628b6a8175b324125afa19cbdd716e5a7561892f10e0f314dec28292ca
- MD5 4e06b5d1230328fa02a0408fb393bb8e
- SHA1 049140ee197954845853b75d7dfe9fc27fb8b12c
- SHA512 77446de5004947bb425306e259995f94286fa3889d1c188571da2cce9ab02e58d9c00d1a9ff5e010d0f978c6878e4a050346f5598127adba90d96c35b74b9316
- SSDEEP 384:S+fie7us29Z1iAHAHJ4He22NbX2a/wvupFxzWdVk3/1412WI5xPc:SdUMniA3z2lNwwx8Ozy
- TLSH
  T1F3A2342FB481A171C3E65534544314B297A9291362078DAC72DD93F8BFE133B92B2F3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
- MD5 4814167aa1c7ec892e84907094646faa
- SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
- SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
- SSDEEP 384:3A7q72y8XYDSDJe7H+KXKKK2KRKuKZrjVo787foI7:3sygyraXjQ7Zl99
- TLSH
  T13B626D6652988BFFD321113AB6A333235BE591103770715F4AA36F947C34A93A63D326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/portable.dll
- Size 24KB
- SHA256 25e5a428e663c6b6c352e7eb313d9fd265e944e0f8f88c7406c3fc15d1ad82b6
- MD5 c9397d267d0d10169c4535f6d5e06a6c
- SHA1 2fc5d2e909d56042d32b3fe0a5ae39fc58d110ef
- SHA512 143943d8e02392ef41c2c43641db9d1737a108defb9cd62a3ed3dce800ccbc8f5997f1d0ea4846ae675e3f2b0efbbd9cebd5c5c0022822d10a89a356983440e6
- SSDEEP 48:q9aX7AL2vnYLtSFs4p3Wj4vLj4GWTQfQx2m28gF244m4y+bAghX:YaLArMpGjsjdTUt2t25m+
- TLSH
  T1FCB2752753F438B2D57A07733197A2ABA796533013D0410D7E7E111A2F3401BCD26F96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Docs/REAPER Quick Start.pdf
- Size 98KB
- SHA256 58045223424d936adcefc09c06f635c30a1aaba0335fc5d5954b43833b53fd72
- MD5 1bddb792fec19750ccbbb8352b2b8ffe
- SHA1 dd300cb011e0d9abd57f41503e31367167fddd68
- SHA512 1438030735aa9549e13b2e275210a9c6bb825329acd568d8c38f8debe04474ce01be5e44ef6b76913d47b59d33c58954615754cffbce67de04f9ccbaa8341631
- SSDEEP 1536:loTqjohGkVSC9aZHu40Y7w58PxeVPM6b24k8frIP4T8m0qd4gBE:1lHfEU03kPm8m0qzBE
- TLSH
  T165A3E738FEF797AD1509230F328571420D7B57C3E980648936CF8E7A1F50AAEC58B56A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  Plugins/FFmpeg.dll
- Size 4.2MB
- SHA256 fa49a2f6f1e1cc710bdda167b5bc0ae8f9fc4bcb50051864a719237dcc920607
- MD5 205257b906b1b84beaabc01e9191deef
- SHA1 94c12b955b1292bc5294f7b3280e471a588bb5b4
- SHA512 403a15cc19274e3cf3f9369cc85b5dd3cf6584d36ff103cfe09b00b7405b1553767abf056a6f5793617eae515f2003697960d290affe17f69a84169ca2636264
- SSDEEP 49152:hZZZQDDcpcPqWtaJehWa97nKFB73MJrQyHzhwmYsbM6XNWS/GI:hZZZig5qZDrAS/p
- TLSH
  T1FC16C60396534778C47E807485EB9279A7313C0C9E905F9E67C8E63039D3970BEA6BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Plugins/FX/reacast.dll
- Size 427KB
- SHA256 39a22205bd4e80e3dcb428f07558527a601e6c989dac25f8132291686db0f0d7
- MD5 b32accdfeb4018a0f627c3c408db38e6
- SHA1 304534563471aa799bf6dd392900b9a9443bcd02
- SHA512 49323439a62e478711b251460d58d81eff856888723026674f1c64814a200845ee4a8824bf7b8d3a2eaacee6a8b0ae53717084547351d38f5dbb2f8f14569766
- SSDEEP 12288:jXfl1JS4ofXjPgikGW6diTkP1kdaJTRuj:jPlzS4ofXjPgikG1diTkP1kdaGj
- TLSH
  T18C94AF45E29648F9C8A7807C85BB5713EA3138490334A7EB27F0CA295D7AFD0163E779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugins/FX/reacomp.dll
- Size 347KB
- SHA256 c3528c05bf72e5bc7b28efed0791ebd9f907bee6cf7060e3dac7ded6d47243d1
- MD5 1ba9253b61ca3a12a94c78222d6a258c
- SHA1 fe9c4a336e58840d861f8c1bf4e05b0a99450c38
- SHA512 9381792e4a74df51c2642f14aa2ca12936241c8c43346b732bfd99cae1326d15033be5adce800a5f054e122277a3d20008bb760bebd13b3edc206026b91d42e3
- SSDEEP 6144:izpE4Zhtd4Ne9KaTqhBurO5LeLrAcaukI0xZO0KRwIJ5cwX5rYYwj8ix:izpE4ff4e9KaTqhBuK0wu90xPyJEhx
- TLSH
  T17C747C47A2A240FBD4F7953C95BB6753EBB1340D0334D7EB1BE046182E777802E2A669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32