General
- Target R6 LOADER.exe
- Size 74.4MB
- Sample260909-s2xtrsxepe
- SHA256 c9634ac75c91eef00c8c078014b3542bf43c2f2669f235460c2efe0a7713b0bd
- MD5 930e2d361f075df9adb7be9c442fdb22
- SHA1 2bc32455bd962ed3c7f1d6eade411b451c614dc7
- SHA512 03e0e48c4473f041ca01f0a7afa3c3cc495919a05f91fd740e772f9c7aac46ff85ee966882b04a9b6cb62cde7799e37cbf2aa2316ff6551177d7b67da4072c6f
- SSDEEP 1572864:f9zHvUMOtMWZMNQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNhZ7y7Ujqf:f9bUX20MNQI5BB7tE0WGN4cbZy7Aqf
- TLSH T1380833059915176EE34D9737E2D2C91B7BD3248B8A59C1CA6BD00E478F6B0DACE78C23
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
R6 LOADER.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
R6 LOADER.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
agent.ps1
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
agent.ps1
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target R6 LOADER.exe
- Size 74.4MB
- SHA256 c9634ac75c91eef00c8c078014b3542bf43c2f2669f235460c2efe0a7713b0bd
- MD5 930e2d361f075df9adb7be9c442fdb22
- SHA1 2bc32455bd962ed3c7f1d6eade411b451c614dc7
- SHA512 03e0e48c4473f041ca01f0a7afa3c3cc495919a05f91fd740e772f9c7aac46ff85ee966882b04a9b6cb62cde7799e37cbf2aa2316ff6551177d7b67da4072c6f
- SSDEEP 1572864:f9zHvUMOtMWZMNQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNhZ7y7Ujqf:f9bUX20MNQI5BB7tE0WGN4cbZy7Aqf
- TLSH T1380833059915176EE34D9737E2D2C91B7BD3248B8A59C1CA6BD00E478F6B0DACE78C23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
- Target agent.pyc
- Size 240KB
- SHA256 ea922baca06b2962e644e18b0b90d066a5941ca7250685f7603c4c6dacbfc6a8
- MD5 82c9efe8aaf590cd38321da895cba42d
- SHA1 2d59774ef7bb3efcb83b0efb8d8341efafb4361e
- SHA512 317f775feeecebb16ffcb2a75422ca777e6d04f6abb9794914b623c46259e19531dba4bc195129c9702b3110044b5413e4e816d93c3618b62f24f88245efc107
- SSDEEP 3072:2vRuAGuc8rcCAzgpw2S9LmpniYr0PZ+YVXyaKImgBJ1ko9magSrj2:cRuAJc8rcXzxAViYr0cU3KImYyoAC2
- TLSH T13F34D745BF71DA7BF84A77768827274AF364C1F1F310CF1322A69069AE96B642C510DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1