RC7 Remake V2.0.zip
- SHA256 9751c10aaff76d553153f10db47d84a9302e2f33a93ff92034c0714b4505c4bb
Password
123456
Behavioral task
behavioral1
Sample
RC7 Remake V2.0.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
RC7 Remake V2.0.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
AntiSkidDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
AntiSkidDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
RC7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
RC7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target RC7 Remake V2.0.zip
- Size 8.8MB
- Sample260916-sr2pzasclf
- SHA256 9751c10aaff76d553153f10db47d84a9302e2f33a93ff92034c0714b4505c4bb
- MD5 8ebd4f30ded7fd0f4c24098b76b8655e
- SHA1 0148fdcf7e4cc3c98ab4870f6676b53f7ad2291a
- SHA512 4b4642a71ea484b8b589e8cfb0823fdf6522d7453f310e0af9a46166e8ed331c2370d6968230736114d1abc5f0a0792487040bb1d520ae0faca22009d3da6f75
- SSDEEP 196608:CdpQApe1r+7RczgjL//RMWPgiJ71tmKSSW/HZsXI2MFAC/izAw:C9pe1r+WzC//RMWPg48KcHZTRz/izP
- TLSH T18296338685DA848D920AB7E771FB77E287C1F168317C8024C23116ED6BFA7DA6F4D106
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/AntiSkidDLL.dll themida -
resource yara_rule static1/unpack001/AntiSkidDLL.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AntiSkidDLL.dll unpack001/RC7.exe
File Explorer
-
RC7 Remake V2.0.zip.zip 8.8MB
-
AntiSkidDLL.dll.dll 5.5MB
-
RC7.exe.exe 5.8MB
AntiSkidDLL.dll
- SHA256 d9662b4a6a239dd96bcd020573d6ab883857288dc6f3dcea74d922ff13b53637
- MD5 695a25cfaa2cbd24b4dd75ecd2752481
- SHA1 cd5f4b53daf6a340c0728c0afc0a33d618220f4e
- SHA512 53508b247038284e0c7d85fc0f5ce547d772fd4fdbc84c1d8a1bbd2cd0a6f0d32a8c03708cce5ebfd560bdf6e3afeb220e94c121342baac1c7a16468d94fa644
- SSDEEP 98304:WVDTZy+m+WyQS+hl2QFuFWVHWpUaTdYAwR1mZZXwoLGK6CJaQ:2oSPaWDYAwsHlGd0p
- TLSH T186466BF1395AE3DFC28B09F4E442CD07D46843F5CA568903EC29787E9B53CA612C6B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123456
Minor OS version
0
Major OS version
4
Entry point
1543027
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
1E}
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
UPX
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
RC7.exe
- IMPHASH 067c0bb3a2cc018b093cbbcc1822e076
- SHA256 d2e684953ca2a7bf5888d50d054151537912e2b7296698eeb1efc55ae03efcd7
- MD5 a815eb12206a37f4cfae33e6796193cc
- SHA1 13a7caae6685f25b7bc9f5d94777f7364e1cfe8d
- SHA512 db634ade467bf802a24c93b35297ef477f0784e9bb36cb27e8c2374b47559a51cf60313fce79564bc1427d1e7a192d6fc299f37a077656b82ba169004f262ac0
- SSDEEP 98304:PTzPoULs8tbgLkukuOjV6nnV5T8EsPDwxNpaz9kfznwqft:rz73tUsu2knnfwH8gOnwqf
- TLSH T19E5622F6A4C46A39C805F2FA69197CE4823FBD5D781D475352B83258EEB4093EE4362C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123456
Minor OS version
0
Major OS version
4
Entry point
5791744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
GetCurrentProcess
LoadLibraryA
FindResourceA
TerminateProcess
SizeofResource
LoadResource
LockResource
VirtualAlloc
VirtualProtect
CreateThread
WaitForSingleObject
CloseHandle
GetStartupInfoA
GetCommandLineA
msvcrt
memset
strstr
_strdup
_controlfp
__set_app_type
__argc
__argv
_environ
__getmainargs
exit
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ptext
Size
333KB
Virtual Size
333KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE