806dca1eab0d68cf1a46b6ff87ab9f819e5f7d035a2630801aa429ebc85ce169

General

Target
Boris FX Vegas Pro 2026.0.3.189 (x64) [08.2026 Multi NO RUS] (R2R).zip
Size 574.2MB
Sample260930-llbg9stwdt
SHA256 806dca1eab0d68cf1a46b6ff87ab9f819e5f7d035a2630801aa429ebc85ce169
MD5 628c1f1e44379e321d472a05b6007b72
SHA1 2ec7bd91cce918c9cb2babf64e34a41fb70a533a
SHA512 1a8a7f7211517c726fb2f39ed5897b868dce6fa9c176ac14553ed2631d3f865b6dff79ec96fd0f662eda8d631c0d291e1ae9d356d0abfba4089c23cbee170e14
SSDEEP 12582912:pBI3KqbDcznaYWU9QI4NjFqMWeEmlQLQJV+ADJUAaHvyqTRPuRU6PbS3:ppzmUaeMD/lQcstTP1RPuRFPbU
TLSH
T159593337F54E683DD8297E3634B2B224063BAA2051858C59A5FCF49CDF268713A3F647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Boris.FX.Vegas.Pro.v2026.0.3-R2R/R2R/vcruntime140_1.dll
- Size 8KB
- SHA256 a0527e7b43d74e6f0c5001e444c20e706a3c956bd4f71632f886f56ff92c817d
- MD5 2e263d9ef77db922a74a10ec4c4d3bdd
- SHA1 327d478fb4ea12f3fc00dae924ea384833eff6cd
- SHA512 3263de825dbc69ad77e6581470bac81f0a8074c64ae0213e3d5ad8dee38416cb7318b49ec7c3817ef4cab3973395507b65a9e5d304cd91a43db1dfc940df6c1f
- SSDEEP 192:+4S8Rho5bCChrXTPxhOlfiNPcn7t4tCvxE:7hopdh54UJcneCvxE
- TLSH
  T1D4023C0BA3984D5BFC2ADFF0C4738B2A5A3AB4014B7542AF50F4112D0E25F907927E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Boris.FX.Vegas.Pro.v2026.0.3-R2R/TEAM.R2R.RLM.Activator.v1.0.0-R2R/Setup RLM Activator v1.0.0.exe
- Size 2.4MB
- SHA256 83dd8655e83562d0e140a0bd48e3212d508ed29ac0746034ae80a74343f09ac9
- MD5 f81d5d51a20f3bfac92674502bec7813
- SHA1 5eeaf573e6461625256d8204cea8f005dc629f44
- SHA512 8800baec70f19a84c24613da9266cccad7a98bbf1f377b7d99d677bf053359fb34947878ca88a0db4150d69ac81dba057ce7cb2397a6054b7514532c6bff49ad
- SSDEEP 49152:9uI2hoDT33hOLLEF42mhzcsEzwbnQ9ATC:95OVEfmhzuinQ9wC
- TLSH
  T1D4C5D13BF28B653EE06A6B3679B2A210983B7A6065124C5796ECF44CCF351701D3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral2
- Target
  Boris.FX.Vegas.Pro.v2026.0.3-R2R/TEAM.R2R.System.v1.5.1-R2R/R2R System v1.5.1.exe
- Size 24.9MB
- SHA256 850d0e5838ca5398ba931f43b2eb819d1ed8aba850626be749af10cb54fc0cf6
- MD5 3db4faa82b088c87bc224f5c5844d58c
- SHA1 5ca8c79ba408fa5a00568686209633772f4515ff
- SHA512 3c7f81cd8bdecfb217a2b75f100545ba67701da3199ac74d1705223f2541ece4f89a6933071cf5a745f3bafaa04391d13e233ab1e3e40b2f10aa33d258351373
- SSDEEP 786432:xiBSQoNtg8Z/WQrapoElnLJr7o0Zf6vqHa629mr:sJoNq8Z/vrHEXo0B6CHafmr
- TLSH
  T19D47333BF18F613EE069AB3679B6F12055363A2066524C0396ECF88CCF255711D3E69B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral3
- Target
  Boris.FX.Vegas.Pro.v2026.0.3-R2R/TEAM.R2R.System.v1.5.1-R2R/TEAM R2R Root Certificate/R2RCERTEST.exe
- Size 15KB
- SHA256 c7142fc351a4d2ee9d1e7e1a394d7b323f966f5f6e082feadb812525058d4319
- MD5 3300094d1ce825bb9c08ab40a123e8ed
- SHA1 2f8efb0fa20fed8104eab0cc8b3c2771c97e5b67
- SHA512 9489e787c5344f82fcaa6a27f4761962403f96d1f4406b42301cf7ac2163453c0605f33466bdeea87b3a86a356497407c423f0a3449916f73a7b626dc5ba009d
- SSDEEP 384:DYIIq01gHwHLU9SP64NySkhIqDcg4eCvdg:Dl1YY9y6qLkcguK
- TLSH
  T14262F8C2B30809D6DD5C46305C17DA284F38BE161D91162B32BEFD6B6DB7B94781E272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Boris.FX.Vegas.Pro.v2026.0.3-R2R/Vegas_Pro_2026.0.3.189_x64.exe
- Size 546.8MB
- SHA256 e000be0eb67a5903d7c2975b17c79bba8c093fd442a6276c76f6be278c049e66
- MD5 18bdbe130356b4fcc5083668fe5dd116
- SHA1 843a16cd93df1e20d0897048d0642d3435efb6fc
- SHA512 2b4eff7222eb090a7530e6c661485829fc81be0c70365a27ea1a403f1dc265ecdcde96d3dd04fd118fff21f1e79a143831886717d9df9e95c1148f360608a4e5
- SSDEEP 12582912:IBI3KqbDcznaYWU9QI4NjFqMWeEmlQLQJV+ADJUAaHvyqTRPuRU6P6:IpzmUaeMD/lQcstTP1RPuRFP6
- TLSH
  T1ED593333381EA97DCC257C3524B66268067ED66142C8D9AC88FCD45CAB6AC75BB3F503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery installer persistence privilege_escalation ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5