86d73fbbc9424deb83f7fd21c940e6af0f20a1fb9daca55bb9b86675663b4f2e

Sharing

Copy URL Twitter E-mail

General

Target
RaraAudioApp-setup.exe
Size 130.0MB
Sample261014-e17exsfw3y
SHA256 86d73fbbc9424deb83f7fd21c940e6af0f20a1fb9daca55bb9b86675663b4f2e
MD5 6877c0b549f9553a622a3b834948b995
SHA1 952d5da0e1f928eef37af6e22b9f0d33edee2c2c
SHA512 a3c3e4e2634d0429135947e2d43213ad91719b15f247234708536feec554bb32c9ecaa6642e1047de020393abfa91ac0d92672bf21f3c21e1f68c00c025036d0
SSDEEP 3145728:6eI+LCvX3jLfSSrfMd6KxEycbcJfKcRL57AN+KLo5vej2X/eESNhWo:M+LE/6iy7tLRL57g3s5vGK4Wo
TLSH
T12B583386D2DCD994CE6BC37C40F4527060E0227B7634496EA99F9FD285BE0D91B87BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  RaraAudioApp-setup.exe
- Size 130.0MB
- SHA256 86d73fbbc9424deb83f7fd21c940e6af0f20a1fb9daca55bb9b86675663b4f2e
- MD5 6877c0b549f9553a622a3b834948b995
- SHA1 952d5da0e1f928eef37af6e22b9f0d33edee2c2c
- SHA512 a3c3e4e2634d0429135947e2d43213ad91719b15f247234708536feec554bb32c9ecaa6642e1047de020393abfa91ac0d92672bf21f3c21e1f68c00c025036d0
- SSDEEP 3145728:6eI+LCvX3jLfSSrfMd6KxEycbcJfKcRL57AN+KLo5vej2X/eESNhWo:M+LE/6iy7tLRL57g3s5vGK4Wo
- TLSH
  T12B583386D2DCD994CE6BC37C40F4527060E0227B7634496EA99F9FD285BE0D91B87BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 18.6MB
- SHA256 0883a9eb407906c12b334d89bc5fbc63bd1df9e0803c252cc8d23cb76b6d58f3
- MD5 77f8e4617a7729e6168944c936960255
- SHA1 caf00f45cfb12de3b9951d25e9d6b70ed79b8b5a
- SHA512 f58e6cd7afee7dc77d562f027ab47c23999fafa87153c674faca646aa44e94469194bfadc94c2c09515ea42c179dd560aea1b5b9d1ad3f83455f163a0d69dc45
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6Y3r8xsJQf8xFTDeQdt+lHx37DoB:y
- TLSH
  T1DF17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Rara Audio.exe
- Size 213.4MB
- SHA256 de1246579cc3b69e021edb97bd2b2968778e062d9e94b0f8172ac1e2913b4a56
- MD5 1caa7a38efef367a8536cf6139902c3e
- SHA1 4745a1199a61ae174db93e5840249e1d0877012b
- SHA512 02adeacf62eebec2f067b31f9526b8ea515f9d88eb60e9fabf0c5cd617b41fb21a783c52b7cd3aa25d880e2ae6f385d2a1187c60a236abb9f2362e85e1327cfd
- SSDEEP 1572864:h95ha2qtuQLwla4Z+0h9XzjCMQkNdn7gfbuYEHZNzwH4CaezGkC1GKse9J2Xlq0n:nrf7bjHUKTU+E
- TLSH
  T1C9B88C03E29A41D9C01DD1B5975A9233FE71B8454B24B3DF2BA447522F76EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 406d876065b5a232945cef02e79b3755f8eb6301bd7b8dfca0d8f09e3bcb10d7
- MD5 e418b4d1e5777661d61cf29e01685ac1
- SHA1 2adcd5014a59e6a4f633f21eeed5db374650d837
- SHA512 3f826bc0b343892a71ca2f7721efc834256d36f192e81e07a030bb6cb51ff3e026610f6440e434cf4b62c78150c9ba8507871dcacb5f47059654be49564896f6
- SSDEEP 49152:gSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqa:ruktcrfNlTyj5byqSJ
- TLSH
  T12F268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 e204a2c5a8f6a29bd4da12ec6cd5d754eeb3ef57e6a9c350ea10aa50fb95e041
- MD5 8aec850ddcf925e03935f5485535f86e
- SHA1 5ccab07ca947ef99e542c631afff7bda9cccd474
- SHA512 799f87eb09944ff18edd73f437235b0fa2ce896b7f789fc913b51f017f232c35db190fcf4a90c5b3dea0d31557eb7d0e662e2eb34b02ccd775369687ac51fed0
- SSDEEP 393216:x9tCn2P9zxhOMXtVz5icpXH5uVUi+ziuP:gGzPdrIVCDP
- TLSH
  T1B2473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 f9383c29964d0cc77d32d872c22e6cc9b94680150e8bcb5e5805c2ac991a5f09
- MD5 259347661841a1c09750663c67f5c4b7
- SHA1 87769227778170544ff8731dcf41b67748277cfd
- SHA512 fefc9b505464a494ce0100cb5962d554361d3cdb053112ad465795c7b727b53c9d411a26de57b20482c22f86be1701e2a4e9f328b9bf9ee9cc741322a5b7c86b
- SSDEEP 24576:PY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kae:wiTMYxy0Sy66Zh7Sh/cyvS58
- TLSH
  T1E3657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 7e504ed81940f8ccb26ac739cba609bb40cf9055d0279356ce5dfc40d4bc88c5
- MD5 7f7c7de607df58fe4cd11cfd16e92f6d
- SHA1 b7372815ce22127671b5d158b5b553bd543507bb
- SHA512 d0a23399cde3fdc83b1d983c93aee581732044c9fc352e0b734a4f8f4e1253aab4feb130216a5298b5622480503151824ab763a4451ea4b39e1c0e44249311a3
- SSDEEP 49152:KlyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bW/1:KlyJGsQsU+is9dNoJAem
- TLSH
  T149E5AD02F2D651EDD019C034979B9313F631344A4F209AEB16909A263F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 525KB
- SHA256 7ac958e9ed712ed13bf55ecaa530fb6054e00ef72d96693f1523943fe62e9162
- MD5 1f31440af3253ad0ec8a04db6194a560
- SHA1 135a4baffd2ae11b0521f139eabb96706f66f71a
- SHA512 50096a86292387ce547521df689ff3eda5a5836197ead016219b9a6b38d844fa0ea3dce1e23fbb5d8cb61db3831680c53e0c73108c50edde2516a751b389c845
- SSDEEP 6144:keQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4gfaguL1iMgV:CG/V/iZJOmW6GVGWFcsfAOugP4g410
- TLSH
  T191B47D15F3E84BA9D07AD1348A438642EB7174961F65F9EF02E052352F3BBE45B3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app.asar.unpacked/resources/apo-vst/GunshotSuppressorFrontOnlyTrained.dll
- Size 242KB
- SHA256 d6eea1ea7ccd78635618c9c9319677c4bf8e1b1cd933f7a968a79567c9f88cd1
- MD5 886f43fd734dc37d23bb39c6f115c73a
- SHA1 e2a13c7ed9b62ebf9866a1c91123372bf4b9719c
- SHA512 5c40dfb43bcff7f7504d22aa95a5d0f1b618e667ee43b70b0c914a472b98e1bf157b3a0a56bc718c9d6d54853affa363ec843dc1d7012503fdc6e48ebf8b97d0
- SSDEEP 3072:dtTxZw1hn8FvF+Ufjt9o+R4aTbbjSxZwJApL4azO3wrQce2VfbPDz:To8FvF+gocn7JAOcjPe+D
- TLSH
  T143346C06B5A00CADD9A2E2398DE70A31F77278815730D9EF0393C6565E2BBC1997BF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/resources/apo-vst/GunshotSuppressorFrontOnlyTrained.dll.bak-20260417-104145
- Size 227KB
- SHA256 f2d532658414c5b5efd0304712fa099c4fab32b0f982a8927230dab09d1a4136
- MD5 37566015526bb0d5c1e0eff7f0c3c67b
- SHA1 fee4e54c19c6b037428d8ded1f520050f5c3d086
- SHA512 6956ae0ef022231248b7fe54d87265ceb9266790e0292da95caebb507d34aa3773aaaebb7a7f686eb485ac0d00c42891bdaaa3af31bb3694e9f84d2adb28488d
- SSDEEP 3072:wtTxZw1hn8FvF+Ufjt9o+R4aTbbjSxZwJApL4azO3wrQce2VfbP:4o8FvF+gocn7JAOcjPe+
- TLSH
  T12A344A16B5910CACC9A2E2398DE70631F7B278415730D9EF03A3C6665E2BBC1997BF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/resources/apo-vst/GunshotSuppressorFrontOnlyTrained_r10.dll
- Size 242KB
- SHA256 c0ae034dbb4da39a53ad99be3cae61fae69acbf7384d9638f4e1f5cd7eef5466
- MD5 f45ace843f6d435a4d28ac8f4f4be1dd
- SHA1 a7f4d5a9451837182fdacf60505e6f77160363b6
- SHA512 8cdd54d7a9eac45bf5a075854f794946f9c7ca9995519acf50234aed2f36b009da0d586753ad916e9c5fc3772274b23c8b4aab321fce744f94ef8855d1334306
- SSDEEP 3072:qtTxZw1hn8FvF+Ufjt9o+R4aTbbjSxZwJApL4azO3wrQce2VfbPcI:6o8FvF+gocn7JAOcjPe+7
- TLSH
  T1F6346C16B5900CADD9A2E2398DE70A31F77278815730D9EF03A3C6561E2BBC1997BF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/resources/apo-vst/GunshotSuppressorFrontOnlyTrained_r10.dll.bak-20260511-123437
- Size 227KB
- SHA256 f2d532658414c5b5efd0304712fa099c4fab32b0f982a8927230dab09d1a4136
- MD5 37566015526bb0d5c1e0eff7f0c3c67b
- SHA1 fee4e54c19c6b037428d8ded1f520050f5c3d086
- SHA512 6956ae0ef022231248b7fe54d87265ceb9266790e0292da95caebb507d34aa3773aaaebb7a7f686eb485ac0d00c42891bdaaa3af31bb3694e9f84d2adb28488d
- SSDEEP 3072:wtTxZw1hn8FvF+Ufjt9o+R4aTbbjSxZwJApL4azO3wrQce2VfbP:4o8FvF+gocn7JAOcjPe+
- TLSH
  T12A344A16B5910CACC9A2E2398DE70631F7B278415730D9EF03A3C6665E2BBC1997BF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/resources/apo-vst/GunshotSuppressorFrontOnlyTrained_r10.dll.bak-20260514-005637
- Size 228KB
- SHA256 5572d4972941ddad6b1d867d90396f048863c271c7e3d4a3a0dd24de4d974e53
- MD5 4cd833dd3f68b862f57acd7d471e3f4e
- SHA1 811c27fe478e008636831a9ff72b05137ae857cb
- SHA512 1acf287b619d004ef5f2be5548c6e93dba2343c017c2c8a60ef82190c66ff9734803c45659407ad4f218c44e5ced5e54e9495fdc7d194164851ab7673396535a
- SSDEEP 3072:mrMOFxJ+tNHoffGgV8L7f0ECvKDDTTSdqSjkX4shL4azOHzQYysS2V0cv:u1ffGgVAC6vqjkX4dcIHyt1
- TLSH
  T1E3344A16B5A00CACC9A2E2398DE70631F77278405770E9EF03A3C6565E2BBD1997BF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/resources/apo-vst/RaraAmbienceFrequencyGuardV20.dll
- Size 236KB
- SHA256 67d83280dd67b2a6b7493831f60f6b380192c839cf982d0831b0537eea1f3f86
- MD5 778976792b435d01b4da1c05d6e99387
- SHA1 68f1597bbd53721e8d495f9071408dcbec9778f4
- SHA512 3d427bbf3003f871740fff12e5f29c5d00c13410cc5c544a99825aa9cef47e3ed18781e47a0b167ab0dff72fbeed228aff59afa06e95636bebb13128c9c066ec
- SSDEEP 6144:yvkAZ/kgrli2mfDogzAnv8BjqZgjxyno5dBiF:B1q4nf0UVqAx+ojC
- TLSH
  T1BE347B4531A509BDD873A23989677506F6723C510330C6FB07E15A69AF2F7C1AEBBB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/resources/apo-vst/RaraLoudnessCompressorLabV8.dll
- Size 191KB
- SHA256 2b584dbb0570136d2b73a8ee8099dfd210813c3b49e7cc6f98684430440f7453
- MD5 7e4c42414092adeadea63b90466b1c0b
- SHA1 14adfe04f7d0604d7ddef5135a56281640470cec
- SHA512 e1be21a921dbbbe0ab2ce9b3255f60aa8f858ec5c106b7f15e57e48e20a049d4703324e890e8c16c3bf5d90b2d0a742916cc723b3a3614f30b9f2c8a67c351b7
- SSDEEP 3072:CRSnFHrXSwrOQu9xDdUuklryhtoEgtw0m4azOsJcFL2V7Tj05:CgnFLXtaQ+UBrnEgzcOKTu
- TLSH
  T105147C4A76A504AAE973A634C5775A42F37278420770C6FF03A0477A9F2F7C19A3B760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32