Overview

overview

9

Static

static

3

RK2X6_file.exe

windows7-x64

9

RK2X6_file.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RK2X6_file.exe

  • Size

    1.8MB

  • Sample

    241121-eexnlayhrp

  • MD5

    4336910525ba1641ff23c0b06591a406

  • SHA1

    ce7b526167c49b983552647372dbd0a8bf869c6f

  • SHA256

    2910659a1b74017ae03bafbed3b3aaf8769c525d58c7e001451276edf70aa278

  • SHA512

    4fa081feafeafd696b47024e4656485cde24370317627dd39ff3bd49194a7275211d994d5b0e03489ea5af3b92ccb98d6231fc86cb9910bc798b4e2d7814d73d

  • SSDEEP

    49152:T4DU/ZadGp2mOhhgTPDc9nwo0kHUv6KL:aL+ioTP8n08m6M

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      RK2X6_file.exe

    • Size

      1.8MB

    • MD5

      4336910525ba1641ff23c0b06591a406

    • SHA1

      ce7b526167c49b983552647372dbd0a8bf869c6f

    • SHA256

      2910659a1b74017ae03bafbed3b3aaf8769c525d58c7e001451276edf70aa278

    • SHA512

      4fa081feafeafd696b47024e4656485cde24370317627dd39ff3bd49194a7275211d994d5b0e03489ea5af3b92ccb98d6231fc86cb9910bc798b4e2d7814d73d

    • SSDEEP

      49152:T4DU/ZadGp2mOhhgTPDc9nwo0kHUv6KL:aL+ioTP8n08m6M

    Score
    9/10
    discoveryevasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks