3be1e472b105e9cffe45bd5aa5fcf0e4aad0d412fe294a0b3b0903b2f91e4eb9

Sharing

Copy URL Twitter E-mail

General

Target
risxn full opti-20260818T204231Z-1-001.zip
Size 33.6MB
Sample260824-qxx8maydpc
SHA256 3be1e472b105e9cffe45bd5aa5fcf0e4aad0d412fe294a0b3b0903b2f91e4eb9
MD5 a6a5f078968138b189804a9dd520bcc3
SHA1 1b982b8def276ed4b5792c5a42759c85ed4620d4
SHA512 a03d4de15fefff4bdef5750a912f08a1e944e58a9a3a5e7ce6cb05f5b3687bf4b1c3a12eb43eaa4b823dec99995409dfeb42a1fcb9425f4c7c5a2f439c82744d
SSDEEP 786432:luLsvH6gtn/DrHMpRAP7mJv3DWS7/X6uawDeUhDcv02BfbkZ5tVnHKctf:VagtnbrspM7ifv76VolA3tbK9nqK
TLSH
T15A77337E4A10868DD34A28F0A3DBEC1417E7E13A5F77594C2E8D479E020A152927A7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  risxn full opti-20260818T204231Z-1-001.zip
- Size 33.6MB
- SHA256 3be1e472b105e9cffe45bd5aa5fcf0e4aad0d412fe294a0b3b0903b2f91e4eb9
- MD5 a6a5f078968138b189804a9dd520bcc3
- SHA1 1b982b8def276ed4b5792c5a42759c85ed4620d4
- SHA512 a03d4de15fefff4bdef5750a912f08a1e944e58a9a3a5e7ce6cb05f5b3687bf4b1c3a12eb43eaa4b823dec99995409dfeb42a1fcb9425f4c7c5a2f439c82744d
- SSDEEP 786432:luLsvH6gtn/DrHMpRAP7mJv3DWS7/X6uawDeUhDcv02BfbkZ5tVnHKctf:VagtnbrspM7ifv76VolA3tbK9nqK
- TLSH
  T15A77337E4A10868DD34A28F0A3DBEC1417E7E13A5F77594C2E8D479E020A152927A7FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  risxn full opti/._cache_InSpectre (1).exe
- Size 125KB
- SHA256 72415c602afd60b5153fd5e44d238b975fd8f57d8dde06968fbc9bb13f170fae
- MD5 d5382d619115cf605dda008f532f867a
- SHA1 33f1e80e86fe3c18d40531155768de89912ec9b3
- SHA512 22769819a1d2f29d3e08e0cda9a0d07c2a38d1aac7cf2ac2039a1be4ba5da4b49d075c68030afc7b4e60574ed44fc23f88aaa5a7ae114ee8f4ca25abb385bb21
- SSDEEP 1536:m1kQrlbFdXO7SGrqspdqriRV+Ns2rcpQ+WKW7RgqoQcWeCFWD/WtSlxmWu8:mxxPGrlqO+NDWQ+WMqoQpFWzqSlxmWu8
- TLSH
  T165C3D08533B13459DA624E3154B5DB74363CBC04AF108ABB32AB7F8FE773B81A946215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  risxn full opti/._cache_MSI_util_v3.exe
- Size 45KB
- SHA256 695800afad96f858a3f291b7df21c16649528f13d39b63fb7c233e5676c8df6f
- MD5 6c748415c350f14fd5b78fa5c37173a5
- SHA1 332d64f5885a738d6ce968172b79b1101303cb5b
- SHA512 c53c5d8ab355d950ae27022dc79f168def1aaeeb64398a553bb96f73d5f1c4df2e085b977a3c558329979b86f99a940fa94e33e671c9dcc5cd7a1310d2eb7461
- SSDEEP 768:1AthLhXIHo+tMCXCBU4copfP4xSwpPO0zsU9RXMJmiuofnC8+d:2kztMCSBU4copwVXz9dMYKfz+d
- TLSH
  T1D1234B0177DD4B3BE1FE0AB85472100507B2F5BA6531FBCE5D9960DE5CA3B808A61B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  risxn full opti/._cache_WPD.exe
- Size 576KB
- SHA256 c21e9de5b28de8edfb6b2264b33846e842f7954ad70fa07b3c652feb5f0a09d7
- MD5 65325f636ac238568a21f389387f0299
- SHA1 acf8022648f3eab3b6da50e0f90301eefe64a3f7
- SHA512 9580e5f040f7adb0cfd5dc8749ddc501c97c849fd7bde4b2d66af6beb5d4a2505546b053723d53009ece3014ee87723bbc23729e43c6aec0698ff514c2ac33a2
- SSDEEP 6144:TRQucww8JJQLbRYX3XJ7Sjt52vljOwsxVDC5Mq7Zj2R7beOW2wmIyWk5QoBN6Z61:1cwoQkl2JI
- TLSH
  T185C4083827F80351F5BB9B3684B507718675BD0AE939D74C2A89359D0872B01ADA2F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  risxn full opti/._cache_autoruns.exe
- Size 1.7MB
- SHA256 f41051697b220757f3612ecd00749b952ce7bcaadd9dc782d79ef0338e45c3b6
- MD5 61506280fc7e663db6715ac2206af6d4
- SHA1 3b42f1e497c909d48343768b58e9e5222d540330
- SHA512 4343ace3777173fbf68c501d15011fec940f9f3eea7206712f9934bab432d15753b4c6c0369eb14b8341221992f964c5a37c23a655255572b1a13cde717b2472
- SSDEEP 12288:g1hJ7jnpTutVfjKHhO5VwocPYOhV6y4wO9y+IpunYtALwBzKn2CXrfZetCvmK2UI:WcaHhMcPYq6+O+puYtAcBzg/7SmGNJ
- TLSH
  T1B1854AE322D9842AC87E4530012486BE07FB6D3E5BE349CB92C77E2957705CD5E32A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral10 behavioral9
- Target
  risxn full opti/CPUDirect.bat
- Size 196B
- SHA256 6b8ed3feccb0b1705738f17d858a4f727db2388201026220ae146ba870d80387
- MD5 e35a486a0ac75b63836df8e69b5ead4d
- SHA1 f57c45d747cbcfa7ae0b7a9dfeda287d19260d1d
- SHA512 b4e4ca0b34ebe269f86801a50a61e84ac9924d7ddb9e83d3433640a0974bd186f5b986dd561af93bfa14b5a911a938d772976421c02841d3b9a9001d7380f4cd
- TLSH
  T105D0222395B5828E29D9C91B38E6ED74B8A37482991C4D9BABB84B286D461B4D621003
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral11 behavioral12
- Target
  risxn full opti/Controller and KBM OC/Disable Useless Audio on controller.lnk
- Size 2KB
- SHA256 b1090e74ec3ce1c3cc05073b10c172b5957dd18d8493d30686530949444e3aac
- MD5 41bfd1ec637c6a2ff36d024590464f3f
- SHA1 86e960d5f98ead2aad9f9bf7bcc3fd325d6cb0ec
- SHA512 ae6ff83aae8ca4c7ad5edc9105a18f63721e4251d97b2556d36ab0c9be36d45652858d9d36892a00bd211f8fcabe6cb4a1ce67c65868ffedd226897a2af63d65
- TLSH
  T13C41C39473FD2949FAF75FB26A772640983EBCA22910D85D015C200D4D3AF85ADA7733
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  risxn full opti/Controller and KBM OC/Gamepads latency and polling rate tester.url
- Size 61B
- SHA256 63814d363b2db418e5ad7c9152ec45b5ee36d1782b1d26ddd8c1feb25f157a39
- MD5 3c4801fe4a306e7f5df354814dcb13b3
- SHA1 64e25c22db669750db06ef728403b4870878c922
- SHA512 241a4f912d002738de34860e346babf1f464cdf5e6f45d0de0f9771531267ae0761ba05e30d42d78fad5cf11a64d95b4cc6f6be3a9f116eb2c6818125bb0e766
- TLSH
  T1C5A022C30008808ACE820C8C80808820C8033080F82ACCCCE800CA08380A03003CC208
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  risxn full opti/Controller and KBM OC/Overclock/._cache_Setup.exe
- Size 397KB
- SHA256 f79bc73ea7e1739cbe6b927331178817335c9c0085c3e1ac7dc406b4d2d15a34
- MD5 112621776acebb34547db2fa9bc43053
- SHA1 9d12297e23f0a91ef42228804d90b9f73744f0d5
- SHA512 9580596e9a88435ceb11672807bf17837a6ec54d36d2cabea6b94c2e6dcac72c94b8c21e03d89bf2ce8161611cd3277f3d157d60e0c75812c5b8e118bc903731
- SSDEEP 6144:4F647mwrGyPXu+39MUwHyruaoLMEyUib1pUjDBoP30753Qc:4F64XGA++2UB0wEybpKHmE1D
- TLSH
  T178846C62F2C04C3BD1232A7C9D1B9364AD36BE102F3D16866BF96D4C6F3A7817915293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral17 behavioral18
- Target
  risxn full opti/Controller and KBM OC/Overclock/1kHz.cmd
- Size 131B
- SHA256 dc9ec769828679267f35b9a729e20e40bc46a0ba8c256f71d8b85dfe0934125c
- MD5 d0ccf933dcf67f48bdcaa6dcdbf276f0
- SHA1 2a7591c36008823f3ef9dfcd091c65412ed8a188
- SHA512 8a5fb1cdcb45382b6eb0f8d6f28444e546e504671e7969f7136b7259b819bba5f7d28eda64f8e299f6237400af37b2429b710c9ce5df0e3a24510af133c6c59b
- TLSH
  T125C048202A4F1C0231472B883253A47BC9DAF106A1E12888A0412A956469D800E6ABE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  risxn full opti/Controller and KBM OC/Overclock/2kHz-4kHz.cmd
- Size 143B
- SHA256 18225218996a5d71c3fd9e31a09f2ff0a94936165719e235a57d8e14a674b682
- MD5 db005e533498d4cb39600ffcb51b7229
- SHA1 533c1734f9bdc87fec5eb9c6af17773f0ad26db4
- SHA512 0c0f309758b0bcd6ea4c062bbcad59812e29a19d13c567f84188b685a2aae27d7670cdce7ca2686899f5d9a453b54bad8c02bddfa667bab6edec5cb899b9f9e2
- TLSH
  T1FFC04C202A5E1C0631876B483253687BD6D9F106A1E01888E0411B855469D401A67BE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  risxn full opti/Controller and KBM OC/Overclock/4kHz-8kHz.cmd
- Size 141B
- SHA256 af95bb8d0d6d2b35e31792ff21ff6763cb7da374b5d1f7a888007cb4da2d03d2
- MD5 c891d08e5b0a9689e2d8945ea3f7bb81
- SHA1 fd618ab33dfd8437b9ba39838673359a450a3daf
- SHA512 0e57deb7e69255a8640aeb472161711b3c7199dff8962f4ae4c8953a345ba39c04ab6b606b4374079e0cb4c3c7c9dc1c0cb0dcded2588781121d3febdf9e1443
- TLSH
  T13BC048202AEE1C0A31475B883263A8BBC9DAF506E1E82888A0412A855469D401A1BBE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  risxn full opti/Controller and KBM OC/Overclock/98ME/hidusbf.sys
- Size 3KB
- SHA256 4f5fcf093e28657b99511954f9289dbda78ac60897c2e1c3013be648e3459f3c
- MD5 315add8888a8ad79ef5b9f6e53c60c3d
- SHA1 7f9e725c303030fc936a1c8c3b056185447d2245
- SHA512 4474c2fb2900e40ff202fab01ff09aae152599ae9bd9b193b7f7cb2a2d9af28ee28c2fbb1cd178afe4d50214964251d24fb3c494bf1f8344288a1d36f1ab3fca
- TLSH
  T16371625217E81472E27FA2F61C730B678267B960DA358B1E5A9447683C7A210FB23737
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  risxn full opti/Controller and KBM OC/Overclock/HIDUSBF.INF
- Size 1KB
- SHA256 9f98870ba3cbf2b992c848bc7447685b70c0a06d2dd31975cbd8ce3e8235e5a5
- MD5 8ead6929ca01c948532fc16cef6b8591
- SHA1 5e2315799e568c9d1536e3770202cac21e58ab94
- SHA512 10ef8c7e218c94d8f969776024b1bd6b67a85886929dba77419b709366a5673dd388b56065141949e13a17426f50e88d81506a286b4dfed6aac7e2c854cef3c6
- TLSH
  T10A318B9A7E4F8A257122F91BAA87CC92F3217054226A310DB5F35405FCD560E603D2FE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  risxn full opti/Controller and KBM OC/Overclock/HIDUSBFU.INF
- Size 1KB
- SHA256 1a259212d637a4d72a023c3cbb78577e8336bdea4711c23f57a78e7230c0b1bf
- MD5 f7e4e141e16ce4af4879ebb7644f7992
- SHA1 c4c14e05903e7786b3b4a5edbf32646c9abe91f4
- SHA512 869ec2759ca89c004f4ea3a452ff0bf4f0eb498d3dbf86f8c710dd68e084173e68ce56ecf208162b1586342ed3062f85e8a2af381d6e906238d03627479b4027
- TLSH
  T10011D645AE4BC220B929F21697679CC2F7226E1612A6350431F78441F8FEC4D942E6FF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  risxn full opti/Controller and KBM OC/Overclock/SweetLow.CER
- Size 911B
- SHA256 03efff5808a28e873f6ce6b425e1036210a867c9544d66adbdcfd19d27f1838a
- MD5 e13a7c82031f70c1d5020507ea6c9895
- SHA1 c415cbf62af1b513b81ed7b707bde0a954e2b813
- SHA512 e3ff26778ef85b14dd7c72753d9e56658e28bf0cef502090aab46424ac1ac33291bcee8e42a8d47e938d91480d517d94706d5bee3d1f80444f1b5627acd6c305
- TLSH
  T13F1167854FF4D503B9D54C46D8FD873D587A57C899112DDF50B14AD50D4471874AF90C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

Badlisted process makes network request

Checks computer location settings

Drops file in System32 directory

Drops file in Drivers directory

Checks computer location settings

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32