cc8a03b2902ccae9941828f4d3a06be678e0d97ef171c9c77c3186dbec54ec4a

Sharing

Copy URL Twitter E-mail

General

Target
R2R.rar
Size 734KB
Sample261022-2ksyxsys9k
SHA256 cc8a03b2902ccae9941828f4d3a06be678e0d97ef171c9c77c3186dbec54ec4a
MD5 348b8c4fb418a8fb9c9505e39b47e90f
SHA1 aa4fb698b9838ff283b5a73d508376f33d08b158
SHA512 628c54c225d8f9b3020ac7e63d2b2423ec882d65891ca7a7f2fbd60fc294222e44b94b7e2a3a26089ca1ec76fb1cff9207508a4e31676f54079b17e5949d654d
SSDEEP 12288:9LkPYdkA9XA5XoQECvV3m1stvnNjM650sCKB2vlv1ocGOdKUAWle05skegW6zRYU:yPYd39QVoQE241G1VLSvBWJPgWORP
TLSH
T1D3F4235938968D455F7C2B62B9259AF3C3EC324F219C3E2C198FCAA4465BE8D4361CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  R2R.rar
- Size 734KB
- SHA256 cc8a03b2902ccae9941828f4d3a06be678e0d97ef171c9c77c3186dbec54ec4a
- MD5 348b8c4fb418a8fb9c9505e39b47e90f
- SHA1 aa4fb698b9838ff283b5a73d508376f33d08b158
- SHA512 628c54c225d8f9b3020ac7e63d2b2423ec882d65891ca7a7f2fbd60fc294222e44b94b7e2a3a26089ca1ec76fb1cff9207508a4e31676f54079b17e5949d654d
- SSDEEP 12288:9LkPYdkA9XA5XoQECvV3m1stvnNjM650sCKB2vlv1ocGOdKUAWle05skegW6zRYU:yPYd39QVoQE241G1VLSvBWJPgWORP
- TLSH
  T1D3F4235938968D455F7C2B62B9259AF3C3EC324F219C3E2C198FCAA4465BE8D4361CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  R2R/R2R.nfo
- Size 6KB
- SHA256 22f9d4ce9ad49cbdbae0581c8ff5c300cfc168be4c7653f02201962669ccdfb8
- MD5 d4eb01444011162963ede56a37bba780
- SHA1 3cc6699b0875062f93559016a1584fe954a5b600
- SHA512 c3a563b146cb9d5445a396bbcbd4f3a4043e27c037b1593b0eff95396da6abb309371dec348d3753e74ac84fdaecf65969046a90515b7f81623a60a9545924b8
- SSDEEP 96:rHMH6DNLnJsAKwzfkTBu4lC6J4VrH0rVFEdj:r59nJsAiBTYXVbyO
- TLSH
  T13CC171208121ABA0B51382B71D1822C4F2DAD64E3D3929E872DFDABBFB57D34517835D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  R2R/R2R.txt
- Size 775B
- SHA256 78e3ea522d82c6c4a20a2a0c9cf44ddb3b87f609310c58efd036233fec616ca2
- MD5 6d6df4ad48cc28b94d8c6aeda45a176d
- SHA1 81d948c05d7ea722fc6f02de4e2a4c49e908107a
- SHA512 6ff2a9e9e6deb9f7e98d34f234a9e552650997cc737122e2ba5eaf0eb9d694abf435ae0e290553788b4c3d77324726e9db0b07c8a2854edd3b07302d64438e01
- TLSH
  T10D01BDA2B10B43A614E043D76E1EA1D5B709D42858607D89F8AC912E238B887E767D7B
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  R2R/XLN_KeyGen.exe
- Size 799KB
- SHA256 0727f0747bbdc0ba30ae6b8ffdd568244c246fd3c794089379c11d53fbf260f1
- MD5 a2beab5ab9e3325e28caff996455e384
- SHA1 b294dbb724464c2d295a72a3c1ec32ce8c67dd72
- SHA512 8ee1fbe4fb6d9d9d41300c8fbd07dbbf5ddad0e5a23fc82aca8c86e6f74e932f46d7b8bf66417025e89ea4f3b0c19e4c591fa2093029a05a55455e543183af1b
- SSDEEP 12288:3c9t2Sll4hOQXpouVFn9OciibEgtUSdpJvaUUbx6ls86y9Mx:3cLGR3HAciiptUkvanAs81+
- TLSH
  T162052350BBD445A7D46D43791573EBD1BBFA7F201266020BBBED3F3E10B2282911A687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8