063fe77707c5b8005fd33d85d7d1824232d973f386e0721188f9959c6032bf63 | Triage™

Login
Reports

Overview

overview

6

Static

static

1

riff-development.zip

windows10-2004-x64

1

riff-development.zip

windows11-ltsc_2024-x64

1

riff-devel...ff.pot

windows10-2004-x64

1

riff-devel...ff.pot

windows11-ltsc_2024-x64

1

riff-devel...ild.sh

ubuntu-18.04-amd64

1

riff-devel...ild.sh

debian-9-armhf

1

riff-devel...ild.sh

debian-9-mips

1

riff-devel...ild.sh

debian-9-mipsel

1

riff-devel...ons.sh

ubuntu-18.04-amd64

3

riff-devel...ons.sh

debian-9-armhf

1

riff-devel...ons.sh

debian-9-mips

1

riff-devel...ons.sh

debian-9-mipsel

1

riff-devel...ity.sh

ubuntu-18.04-amd64

3

riff-devel...ity.sh

debian-9-armhf

3

riff-devel...ity.sh

debian-9-mips

3

riff-devel...ity.sh

debian-9-mipsel

3

riff-devel...pec.sh

ubuntu-18.04-amd64

6

riff-devel...pec.sh

debian-9-armhf

6

riff-devel...pec.sh

debian-9-mips

6

riff-devel...pec.sh

debian-9-mipsel

6

riff-devel...tor.py

ubuntu-18.04-amd64

1

riff-devel...tor.py

debian-9-armhf

1

riff-devel...tor.py

debian-9-mips

1

riff-devel...tor.py

debian-9-mipsel

1

riff-devel...api.sh

ubuntu-18.04-amd64

3

riff-devel...api.sh

debian-9-armhf

4

riff-devel...api.sh

debian-9-mips

3

riff-devel...api.sh

debian-9-mipsel

3

riff-devel...nts.sh

ubuntu-18.04-amd64

1

riff-devel...nts.sh

debian-9-armhf

1

riff-devel...nts.sh

debian-9-mips

1

riff-devel...nts.sh

debian-9-mipsel

1

Sharing

Copy URL Twitter E-mail

General

Target
riff-development.zip
Size 2.2MB
Sample261023-ss2flact5w
SHA256 063fe77707c5b8005fd33d85d7d1824232d973f386e0721188f9959c6032bf63
MD5 de875fb1a000341cdefe7a0caf1a60e8
SHA1 f6287689ef4ffd6675b476089f62017376d8a9c7
SHA512 dbc1a6022c8d5394d20757807221378d6b1f0e56e0ec8bfdb6935d3e6228648a1c3909722ba603da3527560b666ea9f3e160f32e2a3c6a1b83b18707ac8b0863
SSDEEP 49152:8HUYUojqut93xYPMTCmPzx6xyJZivQO0hI7+CS:8HSc9X3xY098xpcIS7
TLSH
T16DB51231471D7906E2897477187307E35ABFEE52411EC6C236C964BA1BC7AC03E6E68E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery linux

Static task

static1

Behavioral task

behavioral1

Sample

riff-development.zip

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

riff-development.zip

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

riff-development/po/riff.pot

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

riff-development/po/riff.pot

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

riff-development/scripts/build.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

riff-development/scripts/build.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

riff-development/scripts/build.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

riff-development/scripts/build.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

riff-development/scripts/check-icons.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

riff-development/scripts/check-icons.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

riff-development/scripts/check-icons.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

riff-development/scripts/check-icons.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

riff-development/scripts/check-quality.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

riff-development/scripts/check-quality.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

riff-development/scripts/check-quality.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

riff-development/scripts/check-quality.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

riff-development/scripts/fetch-spotify-spec.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

riff-development/scripts/fetch-spotify-spec.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

4 signatures

150 seconds

antivm discovery

Behavioral task

behavioral19

Sample

riff-development/scripts/fetch-spotify-spec.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

riff-development/scripts/fetch-spotify-spec.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

riff-development/scripts/flatpak-cargo-generator.py

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

riff-development/scripts/flatpak-cargo-generator.py

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

riff-development/scripts/flatpak-cargo-generator.py

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

riff-development/scripts/flatpak-cargo-generator.py

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

riff-development/scripts/generate-spotify-api.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

riff-development/scripts/generate-spotify-api.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

3 signatures

150 seconds

antivm discovery

Behavioral task

behavioral27

Sample

riff-development/scripts/generate-spotify-api.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

riff-development/scripts/generate-spotify-api.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

riff-development/scripts/lint-blueprints.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

riff-development/scripts/lint-blueprints.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

riff-development/scripts/lint-blueprints.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

riff-development/scripts/lint-blueprints.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Malware Config

Targets

- Target
  riff-development.zip
- Size 2.2MB
- SHA256 063fe77707c5b8005fd33d85d7d1824232d973f386e0721188f9959c6032bf63
- MD5 de875fb1a000341cdefe7a0caf1a60e8
- SHA1 f6287689ef4ffd6675b476089f62017376d8a9c7
- SHA512 dbc1a6022c8d5394d20757807221378d6b1f0e56e0ec8bfdb6935d3e6228648a1c3909722ba603da3527560b666ea9f3e160f32e2a3c6a1b83b18707ac8b0863
- SSDEEP 49152:8HUYUojqut93xYPMTCmPzx6xyJZivQO0hI7+CS:8HSc9X3xY098xpcIS7
- TLSH
  T16DB51231471D7906E2897477187307E35ABFEE52411EC6C236C964BA1BC7AC03E6E68E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  riff-development/po/riff.pot
- Size 25KB
- SHA256 8413ad4001bd8d2ea2aeffc08f15e749a00b7d5cbc209a090b37c565bf5389c6
- MD5 58e2edee5b3bd1ecd5bc41f843ee3527
- SHA1 4cca25f7517850b2e29276d22a7d3abbca804312
- SHA512 35d8b42a8092483ff4bef41cb19da27eb8b5d3264188f92a6a88521ba0d3ee38c70b3e752a5186f78da006a8fd7262c0af7470a4a8f0afd8c651b1c092c6c49a
- SSDEEP 384:kjwQyAmj7SmGnwErBQd8kYCMHm24v+t/ixuLwJXlGYSOOyZRmWCRw:kEAmj7SmGwErBQd8S+/ixuUiYHmWaw
- TLSH
  T17CC26F321068225BC4B417EA5A737BE371491DF1D671D75A2E77A9A23B836CC02BB0DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  riff-development/scripts/build.sh
- Size 5KB
- SHA256 04c7fc17677a61eca42d1fb057cda301847b963f674222112fa02ce2a51b8a5b
- MD5 482082df2bc540cc500f639727031af3
- SHA1 006e4ddaf1d0cba45dc5303227d025cf4ebf0069
- SHA512 618de16ae9d13f50f0e65daae1d9d4e2453b85c8ed211ca09ab729cbd91cb83d67e1f065546ad8b62f056ba6357faf8fb8e20bbf8c019caa51712f3f22ccce90
- SSDEEP 96:d3FjEZs51DrF2OiiWBlRqARH/ARgKZNOG5:ddEZ2nxXWVlYRgKZNOG5
- TLSH
  T127B15425309514F0424B817B7BE765C2A831422F19E57C79B6CE5B443F973E8A0FE2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  riff-development/scripts/check-icons.sh
- Size 4KB
- SHA256 e29b140d9ef35e3a487e0f04ef10ed97d8789c6e247fe0907c5c9baa1064661e
- MD5 cab9e325e58fd0850a93f8a518955992
- SHA1 5bc866f04e8d3ec464239ea1eb50b904ef1d6d9a
- SHA512 5bc53e8525861a3d61e56b179faba4bcfa8a06459b75895af3fc7f8228631d20d7d20bc181b8220a8920774803e8fc20081d2e78f47fe01120f0996b0420922a
- SSDEEP 96:IgYb/WOniFPN3xZAUj67aToMe+hVUArvNk81rR0srWo/mrrxYFMjeHL2mkFNArfc:iDiFlB2r7aT5UArF9rR0srWo/mrr3ery
- TLSH
  T1ACA19426B1758AF01356417BDBC34249B106556B8E799C2A302FD82C5BFC9EE70DF90D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  riff-development/scripts/check-quality.sh
- Size 1KB
- SHA256 2131f79fa87fc55425bfe5157fe44e93b7c1b878a9757e5e5c8d66366d142c8b
- MD5 1237719ec8c52d2869615723adb65312
- SHA1 50e8a3f0028e5b5f7c6d78286ba0caf30f663bd4
- SHA512 4d47b7ae1617bc209ce4622f72baf94deb5d250fcb570b5bd651890144782dbf4d6f9ffa1817a3ffc71462c176ca8d24b1aab9ddee7c6918eb1707321a834e96
- TLSH
  T1B421009B39A947F4120CBC36A94750A07D3E444F0A185C34719F76B0BF286C466FE3D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  riff-development/scripts/fetch-spotify-spec.sh
- Size 1KB
- SHA256 9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490
- MD5 eef48047ef4713e36dd54b252ab3a30a
- SHA1 385227ba5611d290e1ef5621b84728897bd1fe8b
- SHA512 42cc802697093b426c1ccebb0bd062593f3a4a295be47e4c41f16ad616a0f57cf260e4a970d99fc1c54415c0482cfc29ea6c7266d9f87eb619499f9cf07024ac
- TLSH
  T1742163A33A11D2200A1C46416F1991FCE637040F54E9D93F7383449899E6ED2BEF92D8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

antivm discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  riff-development/scripts/flatpak-cargo-generator.py
- Size 15KB
- SHA256 748363684499f66e15cfa6ea6eed83b3f95a30df9d16f28bfee628b6c45aac4b
- MD5 5af6a3027408189448bb212458c40fd6
- SHA1 4da574b23c55ffee292314a65eebd02cfd064278
- SHA512 57063f5e90458d64699fcf727d0efe8651c147d52aca54cb86e32a1f9bf78cdb4bb698feac2a9e40545e4a594128ac669b32444f810224e15cc430e141ac0de1
- SSDEEP 192:JBZoZwo3AfRstrXl7Dk9lOe8Hcw7wJhvr8NC1oFFC3KO5DHgEOfiQWxIoHlFE94V:JsZcf2FXxgvWgXr8bCF5DHgKxIMg4b1n
- TLSH
  T17762C827003A477547939B18792E52C24719B56B760038ACBA9C43119F9D2EEC2BBEBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  riff-development/scripts/generate-spotify-api.sh
- Size 1KB
- SHA256 19ead02ed32da37d04f3fb31de15a1f94160ccdf203630602cc433c53da58cdd
- MD5 681a0df28060bfde84483f98449efd59
- SHA1 d800c9f14f1ef5c1c8252fc10341a5a45fcc6049
- SHA512 3098f7772a689dedff64a2464cd14cd7a87e35369170cab1a999114b61b98e2c644f5c800ef7515341af76e8d7b328f66475f93efb489c1d8419b7802afbd1ff
- TLSH
  T1A23115917900D3F188752253AA80D0657132450B8E667C3735CAB9BBBAB7DC3F36D1A4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

antivm discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  riff-development/scripts/lint-blueprints.sh
- Size 4KB
- SHA256 ed29f4e7f4b85e801ea8978763c9a0c8138a87914999c87be3a0d3ee5f004ff9
- MD5 2ae6f81956728e0896c4d3cde13a4eb9
- SHA1 1056fc5485fa9b4f97da6c63ac5d539bcbdf6cf5
- SHA512 256ee03e3ece2314eb2640ee34d5d38ec6e585f96bc3c9b22cddc1ec061133b2b7cfe37ff0a957b8b9a7240d436104745577fda64ee67d15d690d3f0b21e63b5
- SSDEEP 96:tB65nz/QoXZd54ITtZmlPfQi+XEf6K8S9Q1tSZgFZ:365nz/QoJd540TmNMXdj1Ko
- TLSH
  T1E591736BB44D57F0745E11BA7666A1C2BB8A403F087029F4B58FC1287FB854150FF89A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

antivmdiscovery

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

antivmdiscovery

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy