RC7 Remake V2.0.zip
- SHA256 0606e5111a8d0ddcc9e210a472e8261766eacce2f85b51b548aaf050f50c5473
Password
xxddd
Behavioral task
behavioral1
Sample
RC7 Remake V2.0.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
RC7 Remake V2.0.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target RC7 Remake V2.0.zip
- Size 10.9MB
- Sample261026-ydpfdav13q
- SHA256 0606e5111a8d0ddcc9e210a472e8261766eacce2f85b51b548aaf050f50c5473
- MD5 cc7a4cb287d7da23b76137937e53199f
- SHA1 1ea01a47aa892a118ac33d98d18d5596509f11db
- SHA512 634175728d89e5f6c4bd2f6b68a353d031d40a9a3564c6b2ef9f3e821a5c2ede7bb4f8ecf1f9b6f5ec191b54c65651bfec26e595fad32c32be95da317f381dd1
- SSDEEP 196608:WNivdfZS3P6+Zku6WBLZRLpIK5CTNd0719Rcj2sS5Ezw4KzdpQApe1r+7RczgjL6:WN6XIPb2uvZRLpIhT87Jcyszwr9pe1rp
- TLSH T12CB63393275F45E1325079F856A2A91B40E73061B038A015F2EBC5FDAFAE7691C6EC0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/AntiSkidDLL.dll themida -
resource yara_rule static1/unpack001/AntiSkidDLL.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AntiSkidDLL.dll unpack001/RC7.exe
File Explorer
-
RC7 Remake V2.0.zip.zip 10.9MB
-
AntiSkidDLL.dll.dll 5.5MB
-
RC7.exe.exe 7.8MB
AntiSkidDLL.dll
- SHA256 d9662b4a6a239dd96bcd020573d6ab883857288dc6f3dcea74d922ff13b53637
- MD5 695a25cfaa2cbd24b4dd75ecd2752481
- SHA1 cd5f4b53daf6a340c0728c0afc0a33d618220f4e
- SHA512 53508b247038284e0c7d85fc0f5ce547d772fd4fdbc84c1d8a1bbd2cd0a6f0d32a8c03708cce5ebfd560bdf6e3afeb220e94c121342baac1c7a16468d94fa644
- SSDEEP 98304:WVDTZy+m+WyQS+hl2QFuFWVHWpUaTdYAwR1mZZXwoLGK6CJaQ:2oSPaWDYAwsHlGd0p
- TLSH T186466BF1395AE3DFC28B09F4E442CD07D46843F5CA568903EC29787E9B53CA612C6B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xxddd
Minor OS version
0
Major OS version
4
Entry point
1543027
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
1E}
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
UPX
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
RC7.exe
- IMPHASH b0045caa916b3fd03807524dbcf3ca21
- SHA256 72d936c96966dbf3ca7dc954cca18b7b605e65e34714f41421bff4be355220d6
- MD5 fe47afb3f725e44598d50ba0b8844187
- SHA1 0fd82b3043312db045ce60f39c5ad7dbb12a4d8d
- SHA512 da8fa1df947710ab75decd6b9349d41b0555ea80010be7f228f1d3927fce3fa98b59cd0c9ac31e89540bbcfc6be918f30180d094462733e94277fd55ed7c8fc1
- SSDEEP 196608:hrClXf72vTiA/K+4u5HHDZ3I4hoDVtG7l93I/8wmNGbSq:hryjOTDi+vHDZ3INDa7vIESbS
- TLSH T13D8633627B8A89B0D24431F9CDA0821A05727CD1FC189703B3B97B7C9DB61B7DEA641D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xxddd
Minor OS version
0
Major OS version
4
Entry point
25992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
lstrcpynA
GetTempPathA
lstrcatA
CreateFileA
lstrlenA
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetFileSize
VirtualAlloc
ReadFile
VirtualFree
GetModuleHandleA
GetCurrentProcess
GetEnvironmentVariableA
OpenProcess
GetFileAttributesA
GetComputerNameA
GetTickCount
Sleep
DeleteFileA
GetSystemInfo
GetSystemDirectoryA
ExitProcess
TerminateProcess
VirtualProtect
CreateThread
WaitForSingleObject
GetStartupInfoA
GetCommandLineA
msvcrt
sprintf
memset
memcpy
memcmp
strstr
_strdup
_controlfp
__set_app_type
__argc
__argv
_environ
__getmainargs
exit
advapi32
RegOpenKeyExA
RegCloseKey
GetUserNameA
RegCreateKeyExA
RegSetValueExA
user32
GetDC
ReleaseDC
gdi32
GetDeviceCaps
Name
.bss0
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
CODE
Size
7KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
TEXT
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
DATA
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss0
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.aux
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ