General
- Target Risxn Free V20.bat
- Size 41KB
- Sample261027-srv77avvez
- SHA256 4e37bd063c40d80e10f33043aed0b6e6bd2afc1a1ff22058c0e38ecb402f60f0
- MD5 88b4c193fa3bada2ce26b1762388bd65
- SHA1 3219932b7743f7155918230473d3e9a0b4d66df4
- SHA512 73026b8b16f91c14e685fe335a083e84bd4614a879aba188f61312b91b3a00de62df75deb2b97ad090b66b4aa809b325d15dbf4b6e6cc552ad1ad2fe796416ed
- SSDEEP 768:0WakIAIhcetD0YHa1t7D6Pk6PCPEky7Xb:BId2Mb7Xb
- TLSH T1381362317D251332C698DA20A677EC2DFB223AC398A00B40F4FF359A1BE7645987E5D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Risxn Free V20.bat
Resource
win10v2004-20260911-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
Risxn Free V20.bat
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target Risxn Free V20.bat
- Size 41KB
- SHA256 4e37bd063c40d80e10f33043aed0b6e6bd2afc1a1ff22058c0e38ecb402f60f0
- MD5 88b4c193fa3bada2ce26b1762388bd65
- SHA1 3219932b7743f7155918230473d3e9a0b4d66df4
- SHA512 73026b8b16f91c14e685fe335a083e84bd4614a879aba188f61312b91b3a00de62df75deb2b97ad090b66b4aa809b325d15dbf4b6e6cc552ad1ad2fe796416ed
- SSDEEP 768:0WakIAIhcetD0YHa1t7D6Pk6PCPEky7Xb:BId2Mb7Xb
- TLSH T1381362317D251332C698DA20A677EC2DFB223AC398A00B40F4FF359A1BE7645987E5D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1