70d386c91789304f82ad4a6ed09eb789eb69bf8fe3752b31a9f3cdd5158fbf52 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

r6chams/Ru...ic.exe

windows10-2004-x64

7

r6chams/Ru...ic.exe

windows11-ltsc_2024-x64

7

r6chams/launch.bat

windows10-2004-x64

7

r6chams/launch.bat

windows11-ltsc_2024-x64

7

r6chams/ov...ld.bat

windows10-2004-x64

3

r6chams/ov...ld.bat

windows11-ltsc_2024-x64

3

r6chams/ov...in.cpp

windows10-2004-x64

3

r6chams/ov...in.cpp

windows11-ltsc_2024-x64

3

r6chams/ov...ct.cpp

windows10-2004-x64

3

r6chams/ov...ct.cpp

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
r6chams.zip
Size 750KB
Sample261017-cwpyzagy6z
SHA256 70d386c91789304f82ad4a6ed09eb789eb69bf8fe3752b31a9f3cdd5158fbf52
MD5 cda617eb91d98a4929608d4ddf51b922
SHA1 bd33ae6499f722b0add0e267343020012b7d50c2
SHA512 22ba7493ac0e097a46f8eb277c1c15f88c71e2e1eb847d063f66d2a99c02fe47d42f489b53c84a0da4d52a8533fa77103156708ddff2759d63a48cec4cb059ed
SSDEEP 12288:dQo5ng7SslDTsYoGsJl+NppxFO/mZDuwcHGgfh/xsYSFL:dTng7pl/xOgpLamH+J5sFFL
TLSH
T1DFF42380DB41AAC65E4C8BF99E3EA379EA304C4B77459124D425F71D0B4DBEDB608332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

r6chams/launch.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

r6chams/launch.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

r6chams/overlay/build.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

r6chams/overlay/build.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

r6chams/overlay/src/dllmain.cpp

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

r6chams/overlay/src/dllmain.cpp

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

r6chams/overlay/src/inject.cpp

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

r6chams/overlay/src/inject.cpp

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

execution ransomware

Malware Config

Targets

- Target
  r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
- Size 1.7MB
- SHA256 427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85
- MD5 5fa6554e47eeef290afb69e66661f2a0
- SHA1 49d8e5d7636cd620c9459046df5532e523450a21
- SHA512 4ecf165a81b95365b87e103d16d7b99f96657ba309d440a311d66fbd4fc06053b7fa84808ef36aad337ddc1720587d359cda63331112300569ee95ce3250b70c
- SSDEEP 49152:nazlABR14H+xhkQmtsLnvMWs3ZGkA79ieC92pjzkn9AapX:dBAH+zjap
- TLSH
  T12F855A9C303CE0FE79C998B6D3E3ECC54A3ADAB402A43A654564C2B475AB2F3DD15907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  r6chams/launch.bat
- Size 540B
- SHA256 721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb
- MD5 4b4c38c3c318ebcfd2e704dedfb217e9
- SHA1 309fc2ea1df6a6882a3ff34fbf0c43501f1b7869
- SHA512 cad32ee8df2d1de0adfbbd53f5da65d352417b4553f5a3c0d41cd4a09df489f8a26ed77318b5a7cceb1acf7f1b7526eb264c39e7a445ec94383df28104bfae03
- TLSH
  T13BF05013B4D7533265D10485DC963355701986DFE0005C06F1AFA1B94B49AD7FEBC5D1
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Executes dropped EXE
behavioral3 behavioral4
- Target
  r6chams/overlay/build.bat
- Size 1KB
- SHA256 057ff38e7a13cc47c4f1c89defdcb452334a7849914ce49986a5d4d5b5118b89
- MD5 e0f29d8fc32be2f64cde17c2ec4652c4
- SHA1 fa8c2d372d2bb22964d099f12c140724ec0ab398
- SHA512 818d18b7c68e86b64a4a53466fe56ea5e945afe6f3c2bdceb30276d6121c431672f4f1a9b3b38bdd4c76d2b97569791e2448cb341e6d0f2bc1fa1b31172c7964
- TLSH
  T10041323CB0685613B0E1C90FCE2155E0FA54F34B71A0ADD8705272791FCC38A69AD671
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  r6chams/overlay/src/dllmain.cpp
- Size 28KB
- SHA256 b279003dddfdb79ba397620b2264bbcb52e2a1c58e74590e67dbf178f6dbd2c0
- MD5 5655de573f9ffa33cf94046f6129cf19
- SHA1 4d5d36f83a7cf6a411d53b18b29c5c0b0179782d
- SHA512 2322f06aa4d7b9237b8ff5113fcd901753729e56551ed03e26b0b0f440713a25cabf5c5cedb9b43c8e5b534ccb1f094c01504505bb9167cd7ddeaf3fa119775f
- SSDEEP 768:UOCsppih9E/uC9T67TsJGESUUI4JAXnIO6uVFX8iQG37Vz7ssis9cGlhR:UTs2Tsr6I4N8ssHx
- TLSH
  T15CD2D5B95A8F1411B863D8BE6F872012924970833A2CD505F85EB354CFDE4BC5768EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  r6chams/overlay/src/inject.cpp
- Size 4KB
- SHA256 ba61374d5b68b90676ff0d60a82f97249f47980aad2c34f0c9dc0faae601e5e5
- MD5 d1ad1cf1fe8f3c7976a987c26ef74255
- SHA1 4c64101d356e51c22b7e88d4760c747f18538439
- SHA512 f4c0d3823235c38b6c5090485d48d1fa091089082ca0994e1147019719416a58fedd04afd745f230c3ca324bc6d58c3ad6d72c6d2b6897650c2e2b5fc9858590
- SSDEEP 96:ONVIym2BuOmEQzmben6XDvrev65muzJvhLGvv5Q5GvrcwGvVhH7QH+As:IIymw3PqmAkL06DzNh0brYP0Zs
- TLSH
  T1F6918448A9DB810055F365399B8B4C0AFAE786835328DE117CAD87941F4C15EE9F8BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

executionransomware

© 2018-2026

Terms | Privacy