r6chams.zip
- SHA256 70d386c91789304f82ad4a6ed09eb789eb69bf8fe3752b31a9f3cdd5158fbf52
Password
655
Overview
overview
7Static
static
3r6chams/Ru...ic.exe
windows10-2004-x64
7r6chams/Ru...ic.exe
windows11-ltsc_2024-x64
7r6chams/launch.bat
windows10-2004-x64
7r6chams/launch.bat
windows11-ltsc_2024-x64
7r6chams/ov...ld.bat
windows10-2004-x64
3r6chams/ov...ld.bat
windows11-ltsc_2024-x64
3r6chams/ov...in.cpp
windows10-2004-x64
3r6chams/ov...in.cpp
windows11-ltsc_2024-x64
3r6chams/ov...ct.cpp
windows10-2004-x64
3r6chams/ov...ct.cpp
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
r6chams/launch.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
r6chams/launch.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
r6chams/overlay/build.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
r6chams/overlay/build.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
r6chams/overlay/src/dllmain.cpp
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
r6chams/overlay/src/dllmain.cpp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
r6chams/overlay/src/inject.cpp
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
r6chams/overlay/src/inject.cpp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target r6chams.zip
- Size 750KB
- Sample261017-cwpyzagy6z
- SHA256 70d386c91789304f82ad4a6ed09eb789eb69bf8fe3752b31a9f3cdd5158fbf52
- MD5 cda617eb91d98a4929608d4ddf51b922
- SHA1 bd33ae6499f722b0add0e267343020012b7d50c2
- SHA512 22ba7493ac0e097a46f8eb277c1c15f88c71e2e1eb847d063f66d2a99c02fe47d42f489b53c84a0da4d52a8533fa77103156708ddff2759d63a48cec4cb059ed
- SSDEEP 12288:dQo5ng7SslDTsYoGsJl+NppxFO/mZDuwcHGgfh/xsYSFL:dTng7pl/xOgpLamH+J5sFFL
- TLSH T1DFF42380DB41AAC65E4C8BF99E3EA379EA304C4B77459124D425F71D0B4DBEDB608332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
File Explorer
-
r6chams.zip.zip 750KB
-
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe.exe 1.7MB
-
r6chams/launch.bat540B
-
r6chams/overlay/build.bat.bat 1KB
-
r6chams/overlay/src/dllmain.cpp28KB
-
r6chams/overlay/src/inject.cpp4KB
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
- IMPHASH 5ebf19df115e0714450b60c738943043
- SHA256 427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85
- MD5 5fa6554e47eeef290afb69e66661f2a0
- SHA1 49d8e5d7636cd620c9459046df5532e523450a21
- SHA512 4ecf165a81b95365b87e103d16d7b99f96657ba309d440a311d66fbd4fc06053b7fa84808ef36aad337ddc1720587d359cda63331112300569ee95ce3250b70c
- SSDEEP 49152:nazlABR14H+xhkQmtsLnvMWs3ZGkA79ieC92pjzkn9AapX:dBAH+zjap
- TLSH T12F855A9C303CE0FE79C998B6D3E3ECC54A3ADAB402A43A654564C2B475AB2F3DD15907
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
655
Minor OS version
0
Major OS version
6
Entry point
56752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptGetProperty
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
advapi32
AdjustTokenPrivileges
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
DeleteService
ControlService
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
kernel32
SetStdHandle
GetStringTypeW
SetFilePointerEx
ReadConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
CreateToolhelp32Snapshot
GetStdHandle
GetCommandLineW
GetEnvironmentVariableW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
ReadFile
RemoveDirectoryW
WriteFile
GetTempPathW
CloseHandle
SetHandleInformation
GetLastError
SetLastError
CreatePipe
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
ProcessIdToSessionId
GetSystemTime
GetTickCount64
GetWindowsDirectoryW
GetNativeSystemInfo
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
AllocConsole
SetConsoleCtrlHandler
SetConsoleTitleW
Process32FirstW
Process32NextW
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
VirtualProtect
LoadLibraryExW
LCMapStringW
GetFileType
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=150, id=261, version=35222,
count=12, id=260, version=35222,
count=7, id=259, version=35222,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=45, id=261, version=35721,
count=7, id=257, version=35222,
count=139, id=1, productName=Unmarked objects,
count=1, id=261, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
r6chams/launch.bat
- SHA256 721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb
- MD5 4b4c38c3c318ebcfd2e704dedfb217e9
- SHA1 309fc2ea1df6a6882a3ff34fbf0c43501f1b7869
- SHA512 cad32ee8df2d1de0adfbbd53f5da65d352417b4553f5a3c0d41cd4a09df489f8a26ed77318b5a7cceb1acf7f1b7526eb264c39e7a445ec94383df28104bfae03
- TLSH T13BF05013B4D7533265D10485DC963355701986DFE0005C06F1AFA1B94B49AD7FEBC5D1
- MD5 SHA1 SHA512 TLSH
r6chams/overlay/build.bat
- SHA256 057ff38e7a13cc47c4f1c89defdcb452334a7849914ce49986a5d4d5b5118b89
- MD5 e0f29d8fc32be2f64cde17c2ec4652c4
- SHA1 fa8c2d372d2bb22964d099f12c140724ec0ab398
- SHA512 818d18b7c68e86b64a4a53466fe56ea5e945afe6f3c2bdceb30276d6121c431672f4f1a9b3b38bdd4c76d2b97569791e2448cb341e6d0f2bc1fa1b31172c7964
- TLSH T10041323CB0685613B0E1C90FCE2155E0FA54F34B71A0ADD8705272791FCC38A69AD671
- MD5 SHA1 SHA512 TLSH
r6chams/overlay/src/dllmain.cpp
- SHA256 b279003dddfdb79ba397620b2264bbcb52e2a1c58e74590e67dbf178f6dbd2c0
- MD5 5655de573f9ffa33cf94046f6129cf19
- SHA1 4d5d36f83a7cf6a411d53b18b29c5c0b0179782d
- SHA512 2322f06aa4d7b9237b8ff5113fcd901753729e56551ed03e26b0b0f440713a25cabf5c5cedb9b43c8e5b534ccb1f094c01504505bb9167cd7ddeaf3fa119775f
- SSDEEP 768:UOCsppih9E/uC9T67TsJGESUUI4JAXnIO6uVFX8iQG37Vz7ssis9cGlhR:UTs2Tsr6I4N8ssHx
- TLSH T15CD2D5B95A8F1411B863D8BE6F872012924970833A2CD505F85EB354CFDE4BC5768EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
r6chams/overlay/src/inject.cpp
- SHA256 ba61374d5b68b90676ff0d60a82f97249f47980aad2c34f0c9dc0faae601e5e5
- MD5 d1ad1cf1fe8f3c7976a987c26ef74255
- SHA1 4c64101d356e51c22b7e88d4760c747f18538439
- SHA512 f4c0d3823235c38b6c5090485d48d1fa091089082ca0994e1147019719416a58fedd04afd745f230c3ca324bc6d58c3ad6d72c6d2b6897650c2e2b5fc9858590
- SSDEEP 96:ONVIym2BuOmEQzmben6XDvrev65muzJvhLGvv5Q5GvrcwGvVhH7QH+As:IIymw3PqmAkL06DzNh0brYP0Zs
- TLSH T1F6918448A9DB810055F365399B8B4C0AFAE786835328DE117CAD87941F4C15EE9F8BA2
- MD5 SHA1 SHA512 SSDEEP TLSH