In this document we present the results of our analysis of a sample of Regin’s stage #1 for 64-bit machines; the document will focus on a number of different items, both high and low level in nature. We will cover items such as the main purpose of the sample; the virtual machine used to retrieve and process the raw payload, with its implementation and its metalanguage; the sample’s strategy to remain unnoticed and avoid raising suspicions.
