RTCore64[.]sys

Sharing

Copy URL

Twitter E-mail

General

Target

RTCore64.sys
Size

13KB
MD5

2d8e4f38b36c334d0a32a7324832501d
SHA1

f6f11ad2cd2b0cf95ed42324876bee1d83e01775
SHA256

01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
SHA512

b0329590d2402ddb6dc98553be3cdc48e0e70cd9797a44b6448b97ca31754b999beeebf593225a6254fdddaa9453920431dd8eae894732b6e6438e5b2d8a72fd
SSDEEP

192:PXieNdtikfKSLPMsDvUDkGtVkUTgBxe1HCjT+pdhh2nhpml0idEC8jSJUbueqeul:PXiQKSLPMo0IKP72hpm5dECdUb+eul

Score

1^/10

Malware Config

Signatures

Files

RTCore64.sys
.sys windows:5 windows x64 arch:x64

7363079b9aae7d58bd33c691a613c83c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03-06-2014 09:16

Not After

03-09-2017 09:16

Subject

CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,OU=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,L=New Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:68:c2:d7:a4:c4:71:e0:62:a3:2c:83:a3:6e:ed:b4:5a:61:96:83
Signer

Actual PE Digest

4a:68:c2:d7:a4:c4:71:e0:62:a3:2c:83:a3:6e:ed:b4:5a:61:96:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
MmMapIoSpace
__C_specific_handler
ZwClose
ZwUnmapViewOfSection
MmUnmapIoSpace
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteSymbolicLink
IofCompleteRequest
IoDeleteDevice

hal

HalTranslateBusAddress
HalGetBusDataByOffset
HalSetBusDataByOffset

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7363079b9aae7d58bd33c691a613c83c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

4a:68:c2:d7:a4:c4:71:e0:62:a3:2c:83:a3:6e:ed:b4:5a:61:96:83Signer

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 300B

.data Size: 512B - Virtual size: 88B

.pdata Size: 512B - Virtual size: 96B

INIT Size: 1024B - Virtual size: 600B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

4a:68:c2:d7:a4:c4:71:e0:62:a3:2c:83:a3:6e:ed:b4:5a:61:96:83
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 300B

.data
Size: 512B - Virtual size: 88B

.pdata
Size: 512B - Virtual size: 96B

INIT
Size: 1024B - Virtual size: 600B