df8a6feb356d10bd605323be5f9842f959d40d99d7d100d6c37cafbe6f179d51

Target
Risxn Cracked Tweak (1).rar
Size 939KB
Sample260819-nw71bsvxas
SHA256 df8a6feb356d10bd605323be5f9842f959d40d99d7d100d6c37cafbe6f179d51
MD5 1591879409594670740f21ee85209f52
SHA1 29079c5dcaa61670f6a6d0533ad1c4b2cd591105
SHA512 4a67fc8ca4f66a3d34b3de31528669e55841ca70333e769b3a0557444aa8020ef5d74b9e500950861ee86edeacf5d30e58bef1b06578f73bab720165ecc539b9
SSDEEP 12288:j095NKP+3EPq7q20w36ZL0x9aW/OoST4ziA364ZwMY5okOaYTvXIvPEK8POB:Q95qS+BZ299/OoScziQhZwMYnaTv4Iu
TLSH
T1B02533CC98F2C09BA167A3331D991D8446E2F2992633937E5EF70B652BE40D150B877B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Risxn Cracked Tweak (1).rar
- Size 939KB
- SHA256 df8a6feb356d10bd605323be5f9842f959d40d99d7d100d6c37cafbe6f179d51
- MD5 1591879409594670740f21ee85209f52
- SHA1 29079c5dcaa61670f6a6d0533ad1c4b2cd591105
- SHA512 4a67fc8ca4f66a3d34b3de31528669e55841ca70333e769b3a0557444aa8020ef5d74b9e500950861ee86edeacf5d30e58bef1b06578f73bab720165ecc539b9
- SSDEEP 12288:j095NKP+3EPq7q20w36ZL0x9aW/OoST4ziA364ZwMY5okOaYTvXIvPEK8POB:Q95qS+BZ299/OoScziQhZwMYnaTv4Iu
- TLSH
  T1B02533CC98F2C09BA167A3331D991D8446E2F2992633937E5EF70B652BE40D150B877B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Risxn Cracked Tweak/ExtremeUI.exe
- Size 1.9MB
- SHA256 d44e26f4215875b701cec76a0cbd31fc3ccbfcf070a32a443560d26d036f9dff
- MD5 03016b2151cce83897e058185a2d52a6
- SHA1 5065caa4595905b161a2582a27a8efa64964b716
- SHA512 3f182c6801b049db513988848c2702314c9780e176db4d90b6af5c059054b49c8a52d3f8fb018992f9a088a5efb6364f8d2eda1e31a2ccd926e3cb177b46cae7
- SSDEEP 12288:CG+54Bfw3lvyWgN2HJ4oc55XttlQ/Do+FIIHD+lL+9BdA/RKRxkLmREJI2YfP8sN:c4BSESXi5Wo+sw9BdAkRxkLIeW
- TLSH
  T1B4950EA1F69158F0FBBD20B0D3DDBE64172DB80A1BB19507288775074AA1A47394F2EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  robustdreamworks.dll
- Size 36KB
- SHA256 64aff8eff0a741d0299ca8bf2362096d2958d7a7e061cd48788937bbaa4a448c
- MD5 afd4aa5b058eab0ebd781e2b04a8d6ee
- SHA1 bb1ba7446ad3de79a17c4507811593b989e15ab3
- SHA512 237ddeb302a62f850b0dee63976f2a9911a8d5520c1aed42a82458ba733f6f09fe5888fb3815cb0810d057d5fa86a9506ecc7133ea07cdf7c1c7475bd0e97295
- SSDEEP 768:RqQfF8DoIFfL+449HgSfNM1OA3n8pBwnQeY6:eDoIFz+R9pfNM15Znf
- TLSH
  T1ADF21851576CC237EAEE5AFDB072501227B0DA213386C7AEBECEA16C895371D12107DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  robustdreamworks.pdb
- Size 145KB
- SHA256 829a7f41402c1dd785d721c28f3ad659b0c25dd5b8d3b466679b1c5a31405ec5
- MD5 d29223ada19073352baf826458a0b6ec
- SHA1 844639535025829b825635a5583b21309a770e69
- SHA512 b29530d7747903b3145d7a53a4a3c7debfd1588a8533e3d082eca7896f888462075f41fb8c7d7c8e9ac8ee927ee24aab488be1dc47ca8e7aa16676822af5c30a
- SSDEEP 1536:lA/RYmHcJyCiaxAQUllAEbqw/wF/sllAAw:loH5ZIEbSb9
- TLSH
  T19CE3746BBB50C631D864C874799B4B5D0634E9C8D782578FA356F02C3EF33A92D8B264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.deps.json
- Size 3KB
- SHA256 82321b4d9a99f5927004dbec3190611816c801cd80f9743686360361c9a49c0b
- MD5 b17f1b3e08d30439aea4700d08a064f4
- SHA1 61b4c4cd279f305f8c20a8d9991d5a96c35191a9
- SHA512 2a7088dd5c28849c4d52cafea3a4685d6b0c631088e176917551f418fbaf45adf0e3a3e13e5ccac34605fb4b418e78df46a964e5a9b83b898cad42aba0936699
- TLSH
  T1EC61A416F9804EA711B41BAA2E794781F230037FD504290FB8FC7A6E8F76E562204FB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.dll
- Size 27KB
- SHA256 5ef7b10d5f62832fdfc2a5d9608027ad3ae5ab3a48bfd84d38ce2aaf66b5a5ea
- MD5 574a26e2757a5ff8875cc532ef877541
- SHA1 066f16ce003c0376dbe2269552b943031317f0e2
- SHA512 a76a798d78b6cb46c747452704ed9ae47354c3a5c865b17d3880e1658c942eaf9fa6d4b235ed53ef864db5169dbdf8e85947317356eb78cc0d8037d0c186ffe6
- SSDEEP 384:a8JawDaZLaXuqnw2ohqSttQDjWJ0VOqBz/maaIrMHT2iEqfxGKyky5baII1yfmax:a8M5LZtrJm6HT2iEgBbf1ShFKG
- TLSH
  T14FC2080C73CC4516C3FE43B7EC77444987B5B2132C21DABE8BC585652CE2B9A8562BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.exe
- Size 135KB
- SHA256 93482943e4b184bf53b7b19c460fd273d24c5faf0ec98b7c2e2e1e7eee9282ac
- MD5 6a1e370f2ea783fe05fc4e7e8f2bb0fe
- SHA1 1b974c9ed7ce6442ba1947c64d6f1ddaff75c775
- SHA512 ec6f585f81622bb6dacedbeda7ce37b4f4969c576a2b32402aa5228b8087e94a7dba570870698dadf40dab1db9b87c1a502fbc5a035edb4b037662903b929714
- SSDEEP 3072:zhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfx9RhBur:zhK4XycqgpfCup5sVxuZ041RhA
- TLSH
  T153D32903B2AC11FDE1BBA37C89A21A05F3767819477297CF0390856A1F67BD09E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Risxn Cracked Tweak/emu/KeyAuthEmu1.3.runtimeconfig.json
- Size 268B
- SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
- MD5 9fcdf880f73e74cf6347f8194b9f3509
- SHA1 ab571c7ed4920129c89c7e083f3c9f22597198bc
- SHA512 23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1
- TLSH
  T161D05E29CE405DA715FEB77FDA31C282FB34931B102418A5B4A8400C2FB7AA90201F9A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Risxn Cracked Tweak/emu/Sodium.Core.dll
- Size 48KB
- SHA256 2148beb7a50d1e3be306ae4d3abc2276696744e8c926e39be7834e1e6b714084
- MD5 b749cd8d4a51e0e16a8e135db8163890
- SHA1 dd509b9f26849a6c7152d779438e0c56eb693cd7
- SHA512 a3006246db11b291381a3ab46a874b724bee54b1a146aa5e4787077a9f273e82a7d6dc90dddd083dc1f252dfdcf57921bcff2385730e69e7c76edef54530612e
- SSDEEP 768:ulLHjiNU09oOk+5RXqvS0hw9bfWS0mIK++ggwjkDENhEg4EgRe5S+U4opU4zU44z:ulLHjiNU09oOk+5RXqvZhw9bfWZmIjDQ
- TLSH
  T1DA23F994E7E29B11D7FD4338B8BA53319F31F88E6432C78F538500E994527A98168FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Risxn Cracked Tweak/emu/runtimes/win-x64/native/libsodium.dll
- Size 337KB
- SHA256 597e80901f20bd742bb9102e17572278341cc77acd283dc47f172b9ca8fbda4f
- MD5 7462950478708e413d32c5421280c056
- SHA1 68a5fa3cf4be0ad8417a89b1efade07c4ca18757
- SHA512 2d422baab92d65e58a71c1bae5de4ce9e3738ab3b840e1e7f91e7fa39ab72d13865014e5c7b83f18f3c5b311d683159d0ede389fcc2a4e16767a61da1badbbca
- SSDEEP 6144:nqvR7IKDFtdOd3eoqe8FvexQcYz6WTCOMCBJluJuWV50DEr41DEl1wRAyO:nqOz0PcYz6WT7MOJluJSDREMAy
- TLSH
  T1B7746D5EF9EAA5E9CDB3E078C2BEC6A6FA55380C43E057F313C2495429537E14638B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Risxn Cracked Tweak/emu/runtimes/win-x86/native/libsodium.dll
- Size 325KB
- SHA256 37dac83fc735dca24ddaf9e5f454808d029a335c1055bf6a8d03cab7d0a245b0
- MD5 0ba2909787356c6172bfcc1fe75417db
- SHA1 9f99646fec3f8029891b906a93288a1f3205616e
- SHA512 1e7111f73de23f526d480daa779e6607bb3469d8e185208918cb19bcf3912fae6c814b5a51915c5f658a06dbd43db28cd6a79af2fd3bcd02355d8d00da725442
- SSDEEP 6144:8ltkw95OlpOAzqqrb40Wzs3WsX8PPDrAA5h1hRqc/SgUyJztOWDxV50DErGuN:8b95OlpOAzqqrb40WhsqMcxweJ9YWqD
- TLSH
  T18F644A21F960B157F5D21479D2AF86F769781A3063FC15F3EB92285920734E3A230B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Risxn Cracked Tweak/readme.txt
- Size 9B
- SHA256 9b7f5c7cd6ebcaed0a6789512464d440b5982e6a3a766723bf9d6b61e8fa76b5
- MD5 be5354cd1cc545a4e2a606e24bb3190b
- SHA1 e2f993dd3fc484765a97a50724c2ae0a1489acb0
- SHA512 8ee20b07d17eef70092c203d991fb997be85ba3c4ae4c43e0cd5a398535f6e561a03549ef3f5a2633293b5a81cf27da17476a15799c5c04a96fa7a26ddf839ab
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30