General
- Target SorryRKN-Windows-1.5.0.zip
- Size 57.2MB
- Sample261102-s637cabs4y
- SHA256 b4091e480040591c896ae349ecd4b03d825b26d06599da5ce11f00b4bae76c4f
- MD5 dc7a845db62d289082716432e0cf529c
- SHA1 bd82fc66903c9600f3340794e0140dd137d3537d
- SHA512 393f377fc743c283ed4bc7f438a915a4862fd760297795279c8b44df80959045fec83b7f455c455fac316ce43910320af82cf88d5465ef3d0fa76ba23db1c5c0
- SSDEEP 1572864:Q5CArruFdmpaSn8I3mYk0ZfjYpOeH/V1sicRNyHwpdk:QMS20p53Wwf0seH/XeRNWwp+
- TLSH T1E0D7331984F8A297D4C25C3FA8BA71B0B521D596C5BA603F3F7127B0524F6C60E67F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SorryRKN/SorryRKN.exe
Resource
win10ltsc2021-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
SorryRKN/SorryRKN.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
SorryRKN/check-network.exe
Resource
win10ltsc2021-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
SorryRKN/check-network.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target SorryRKN/SorryRKN.exe
- Size 7.9MB
- SHA256 e429e1b6ca41412731b01b183431d2d93f73f4c7444c9bbfe4e004e10f9b84da
- MD5 5c37ee454a3921be3399c84abfe39a7e
- SHA1 86927cc2b5ff77ec7538f5f69b059e1b6a17e13c
- SHA512 7b1fa9820b2e77130b21495e67c561dddf5b8d65701c5d9d5d03b92784b33d30115c2c0b1b7a52587c3f247a7950f4a2e092e5e5342865cf6e0031ab67cd331f
- SSDEEP 49152:E9mLceYuJFyzucbxuhZjBGxdmxC62Qg7qS9frOD3n3s131VP954u/8rZGDjoRZ1Y:EQd0xnjQLSxOu+uAZbN9xjyEWDF
- TLSH T137865A07E8A109E9C1EAD27486229253BA717C4D9B3523D72F90F7782F77BD06A79340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target SorryRKN/check-network.exe
- Size 6.5MB
- SHA256 519f0186ad47f577780410de74e2392a2da177efacc09d4f6fa3cb966a942ea5
- MD5 fe7845fe15073dd4fc6c8ac452fc2677
- SHA1 4b8c5fc74b26d0cb2ae4a6a341dbb3134f3950e2
- SHA512 38920759463d847a047803bdf8c339eb91d599ac78aa1516064771a325e4f5124170537e20b9816fd94a11ce8a536575ec6edba019cd13c884649d9fd3342ab2
- SSDEEP 49152:lb9VYaJYU40GmY4X94bdItnhs3Kz0Osr4sw0d+aIGSBEh3u4rRoCGVOtSwKeK9K5:l6mYWUKq7w0Qa8B5KMn3E
- TLSH T14D665A03E8A115E5C0A9E2358A76A253BF717C495B3123D32F90F7782F76BD06AB4750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.