Overview

overview

10

Static

static

10

R6SGlobal.exe

windows10-2004-x64

10

R6SGlobal.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    R6SGlobal.zip
  • Size 4.7MB
  • Sample260815-sppbvszsdx
  • SHA256 f56259af8f532ab8d172cd2b50969b6752bfae2b3abd3ab1ce2fb905e85bd72e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
r77googlepersistencephishingrootkit

Malware Config

Targets

    • Target
      R6SGlobal.exe
    • Size 9.9MB
    • SHA256 2b19b9566a247c250d1bb74b8b6f79bd3452c319a080a8d0e5743091030c9ef4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    googler77persistencephishingrootkit

    • Family: r77

      r77 is an open-source, userland rootkit.

      rootkitr77

    • r77 rootkit payload

      Detects the payload of the r77 rootkit.

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Detected potential entity reuse from brand GOOGLE.

      phishinggoogle
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks