General
- Target raspy.zip
- Size 2.7MB
- Sample261104-2faxjsvyaw
- SHA256 b58a39d1317363ac5484efb984f6568d4d89cd9e629cf6f6f52e850c3461c5c1
- MD5 b1e54d7f2bc8efc783a2729730924853
- SHA1 a146de79bf038c0868ba613dd64373584d8bc091
- SHA512 39fa748ae19879c325c9476b70d8f8342713945a4f244530c9cda214ee65d866f0a04a7f4b7c5cc7787554961906f020e1c5b32832819317e294b412b4fff110
- SSDEEP 49152:LFIS9FfKq9JFPFvVZrrBuxS7jlw+hrrUcJz44m5DNEofifg0K2:LN9F9FL/BuOxvBkqM2
- TLSH T1D6D5334363A0ADD9066AE7C70693809389DCB721B27CDC57BB4F2099B6079BF7C06E54
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
raspy.dll
Resource
win10v2004-20260911-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
raspy.dll
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
raspy.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target raspy.dll
- Size 6.9MB
- SHA256 132577df174d025baf0a61f22f2c515a7ee349f48db3c7d260033bcdb65b46c2
- MD5 018400fc5cdbde5a5454cac4b7bc8a64
- SHA1 b4c9924a8a2381899cbd52e99aa87f3af6f745dc
- SHA512 388735fb8ffc9130fef7a98993a0c02f2185255f1fc5432f74c48663b4243ffa0d5f88790edfcb1ccb15e3a01140532167673c49deadc11f17f26e0cdde53bc6
- SSDEEP 49152:K1zK0t8CZ0xLgA5YtMBE3gGijKLZ/t074:K1L0xLgA5aZ/t074
- TLSH T10C76B647D59F0C9EDD0B67FCE4C35338AB34BC46CC1968AEAA45D9256D83E813A1EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target raspy.exe
- Size 11.7MB
- SHA256 9b4b8164285b081be18cd12ddddc57659b5d85faba5ff84d66ebfb4d144cbb29
- MD5 7dac5a4274f6309eb853b175259ec833
- SHA1 99e7d84363341e5a63191045fe20d555ceedf6b1
- SHA512 da89fdda642e590ed657adcf9af16ceb495aa523d12c213dd1e206baf806ec98fad7315dbacc87edbfeb0589a1159bda32a158897a4c1b01c04f145242c0a4a1
- SSDEEP 98304:3ACIcMtdK5oZsWKyCdpj6tqW47zhOBCkb9miieIaH8CO5d9u/0YY2o3QwBSHsg5A:tfMtdK5oVFOG0QHo1l+oUvfttq
- TLSH T199C6D697559F5CEEDD8767BCB4C3632CAB34BC16CD29686E9604C835AC83A403E1EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.