27c27f928a91ac49770b7dbb20c88475b94be86e2350c62bc8ba348516464315 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

ZapretRKN.exe

windows10-2004-x64

7

ZapretRKN.exe

windows11-ltsc_2024-x64

3

bin/WinDivert.dll

windows10-2004-x64

1

bin/WinDivert.dll

windows11-ltsc_2024-x64

1

bin/WinDivert64.sys

windows10-2004-x64

3

bin/cygwin1.dll

windows10-2004-x64

1

bin/cygwin1.dll

windows11-ltsc_2024-x64

1

bin/winws.exe

windows10-2004-x64

1

bin/winws.exe

windows11-ltsc_2024-x64

1

general.bat

windows10-2004-x64

8

general.bat

windows11-ltsc_2024-x64

8

install.bat

windows10-2004-x64

3

install.bat

windows11-ltsc_2024-x64

3

service.bat

windows10-2004-x64

5

service.bat

windows11-ltsc_2024-x64

5

utils/scri...ay.ps1

windows10-2004-x64

3

utils/scri...ay.ps1

windows11-ltsc_2024-x64

3

utils/scri...en.vbs

windows10-2004-x64

5

utils/scri...en.vbs

windows11-ltsc_2024-x64

5

utils/test zapret.ps1

windows10-2004-x64

3

utils/test zapret.ps1

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
ZapretRKN-v1.1.2.zip
Size 1.6MB
Sample261027-xf4seawvbx
SHA256 27c27f928a91ac49770b7dbb20c88475b94be86e2350c62bc8ba348516464315
MD5 73f3af6449e23bbe77b108a9b45adb51
SHA1 a092fb94033075b5fc38915f49657053850bded8
SHA512 06bbf089b416a0f0c10b1ee38193d0f92ea6b972f906cf226e105eecf193e8ee0d77c0b57d2453b7afb9b561a486998279714e9798ee799a8e640a6b68825342
SSDEEP 49152:uctuTQ5NorTHGxnUta5bvLokMbHKxBgY7wSr:1tuUHUS1zdDokMjKx+LSr
TLSH
T12975336BA081EB8BE27153725C0E485546E6F19171B07F8D7FCA3908CB21CD35BB89AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ZapretRKN.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

ZapretRKN.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

bin/WinDivert.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

bin/WinDivert.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

bin/WinDivert64.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

bin/cygwin1.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

bin/cygwin1.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

bin/winws.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

bin/winws.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

general.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral11

Sample

general.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

Behavioral task

behavioral12

Sample

install.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

install.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral14

Sample

service.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

service.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

Behavioral task

behavioral16

Sample

utils/scripts/rkn_tray.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

utils/scripts/rkn_tray.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral18

Sample

utils/scripts/run_hidden.vbs

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

utils/scripts/run_hidden.vbs

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

utils/test zapret.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

utils/test zapret.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  ZapretRKN.exe
- Size 33KB
- SHA256 12dacb5a279b5085e5e54433fb0684531a04263f93c2b01cd50e699ba7ee6588
- MD5 ac3dcb6408650947831140442bc73564
- SHA1 487af9a47d96cdd229a336ad39c7d1468d28e3c2
- SHA512 44cc0be98f7281a4b94b3c40088e7b703344b944bef42db39cb429e5d2ce307fd2721a9dd854a41099cf26acfa30b0d003bc91378574105a3f6cb7f3a0e168a5
- SSDEEP 768:N01kfBHSaeiEl+IB95EeHeylO9T0t2vZMG7:G1kByaeiElB5SylO6shH7
- TLSH
  T1E9F2D063B7C85A75E047033344B14A04A97AAF665017E34FDD5B832B6A73B608F12EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  general.bat
- Size 4KB
- SHA256 86851d1db0b147d6840428a1d5f56aa2286677566848cd1c647589f0241d6238
- MD5 07e87d99be4100b4f76fd178add6447d
- SHA1 6c6782083c310d99462c19deb550ed860c93d205
- SHA512 ee4f5741371d6d62216d0c990e771fd3d10c9ae66e27e8f36e941e1b8720f345caa38883a2e16c2881d44f092866bfbd54f8f7fbf2671001bc0f0dd9b4818e9e
- SSDEEP 96:162PQGB/GRRQ1zbIKdUGB/GRwVv/GRRQuv/GRw5P+R2rS5+RRLx+:XPQGB/GRRGEVGB/GRUv/GRRDv/GRkP+v
- TLSH
  T1079139A3E00DEE4AF6CE757EF45EF6A5201398C328D6D452439B49E8CC0EDBA595E084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral10 behavioral11
- Target
  install.bat
- Size 5KB
- SHA256 dbed6292670df1e715bf3c91f579bf90e4ce21cf7985ae2f2118496f7b5aeedb
- MD5 d5be529c5bfe2cec5f706702402cd052
- SHA1 e5dbbf64ba265768c7747ed8fadf8e6f36cefea8
- SHA512 4ec69849c6c2e4ed0074ae12e4e37fba8443e699409fd924b4179c40f32bc1233f15db18f69e976be3b47f6259385a56dd699fd5eb7e54b70f3e704960db1d34
- SSDEEP 96:BUwMzS7dj736DTZAH7opI4NS38jDj34AWgBG9Livx:+zS7dj7363ZAH7opI4NS38jDj3Sgw9LW
- TLSH
  T155B1C56C3E89E459093D432B8A7C0645F84B08EF3A76DAA93016B53C3BE57E183DD0C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  service.bat
- Size 42KB
- SHA256 1f8fe8c73cb7cddd3ea7b1a682ab42283cff673b979e3e696ed547944fd9b6cf
- MD5 43da25d32792a5fd8dea991f1e4ce91f
- SHA1 cadf594511aa2619d1dba8b5f042b8664c220108
- SHA512 693d595513abdef051cd4f5be3b2db81ef14482721034fff8e151caea534fc3829092d466e0bca5465aa77a92d6f4e84fa5dc8cc4a15909c3082a5d95d026572
- SSDEEP 384:LNuC5R85uxFcIoAyk8ADKkLFxxRzjJwcjC1XEjW4Di5TR/5UjGz+oZmairc0h2Vh:cC5GAdKkjCkWxTRIp0NJ3yayugY
- TLSH
  T17313B566140258660470A3B7E81165A5FB5B81FB1B3662DD386CC06D7FBB32385FE2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral14 behavioral15
- Target
  utils/scripts/rkn_tray.ps1
- Size 12KB
- SHA256 4ea4b2b6bf03c21bb743c2601bf7073238c9802214c15f896a9e343434c7a094
- MD5 a368f7a9cc74f4bc403981cbce2115b9
- SHA1 4eb7e4da582bb7c3e3e85c7a7fbed4a132f7a3f0
- SHA512 d69de64020397806674c92e8e0068363235a6fbc8ae25e3e7e18a6d51f6aa71ef99ca4169f7ca88185bb7f6644c0b4e990b5bf18b38b8458aac9fdc3592a7590
- SSDEEP 192:FclvQVclP4oRJWfFh824Rm/CvaLc+7zQ7dPMTbcgy6wqvauZBoQnCQtJIBjvozHx:SRQWFRgfF27p++dPEHZBoQnjIBjvOR
- TLSH
  T14542A7182F17E062C7B2976ADE828556ED230177965CA81D75EEC09CEF30418C7B4F96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  utils/scripts/run_hidden.vbs
- Size 370B
- SHA256 c1cfc5d9d03d688a90eed4993fbb792c5dea8fa2be6094fcf0f44f336f0e2156
- MD5 bc548ce8bf9dd16eb75a62325f8e8d59
- SHA1 45ceb670a2f974d41f9912dd67732692280c6ce8
- SHA512 968be21c4671af0920279e6c8700d367a3f31136059d8491012ddf906d4ec7f6790147c8a6d72023e70c1e005739a7a635891a9430516acd54bb2f50d0230538
- TLSH
  T1D8E0C007EE0FD1DE81E291539061DC1ECF55A4F97A7381B75D60C81C2021A780FDB103
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral18 behavioral19
- Target
  utils/test zapret.ps1
- Size 40KB
- SHA256 13ce2b57b35b9a0223b0ea2782752bd2e20f550e2b7f0e9de8ae8d3999bfd402
- MD5 9ccdd2334a390cdb5b153a872740f901
- SHA1 748038a97478b9a689af0f4c2b573bb988bac75a
- SHA512 6a0ea6c8785a3018fc564777d4afd6ff67d43bbe5df203d3d85b1cbb3dab311cf250a4bf3fe7edb73928c0449d24a266743bebd1be7563011d1bb6c4fdbd66cb
- SSDEEP 384:ZmnJMakddb1YJz1jbdZTP/9lnXVqkNC5tJuyci8EULNWByBwdH2I1H1UVnVkGySm:Zkk3O91g5tJtciOsByBwdZ1H1KCxt
- TLSH
  T12013B62AB90A106B467357BFDC81A104FF57017B800D16D4BD9CA0D87FF492DC679EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Visual Basic

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

© 2018-2026

Terms | Privacy