Overview

overview

8

Static

static

3

Rbx2Source.exe

windows7-x64

6

Rbx2Source.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rbx2Source.exe

  • Size

    8.2MB

  • Sample

    250115-w6kxjs1kc1

  • MD5

    2b83a78eb7a9b2b170f3c6f9dc4625b9

  • SHA1

    ec53430afae6bdc2251d70a9741b2550919fd1f4

  • SHA256

    43298ca3117a32a1081009466e3b006f106d53eb6ab1de6f9dbf2fbd67a68cc8

  • SHA512

    fc711242d522d220e62de1f980203620035747b47e2ea9ba2875ce191fbf23fa265d17f395ee0139df109e3e971198718ef5829a69734b2f293856ce0865100a

  • SSDEEP

    98304:Z0qIiAdex4Wyg5hLerqDeX0wjgw8HQD22wEQjGkqXf0FQtH8:Z0s4QvfaEwjgw8HQD22wEoGkSIQtH8

Score
8/10
steamdiscoverypersistencephishing

Malware Config

Targets

    • Target

      Rbx2Source.exe

    • Size

      8.2MB

    • MD5

      2b83a78eb7a9b2b170f3c6f9dc4625b9

    • SHA1

      ec53430afae6bdc2251d70a9741b2550919fd1f4

    • SHA256

      43298ca3117a32a1081009466e3b006f106d53eb6ab1de6f9dbf2fbd67a68cc8

    • SHA512

      fc711242d522d220e62de1f980203620035747b47e2ea9ba2875ce191fbf23fa265d17f395ee0139df109e3e971198718ef5829a69734b2f293856ce0865100a

    • SSDEEP

      98304:Z0qIiAdex4Wyg5hLerqDeX0wjgw8HQD22wEQjGkqXf0FQtH8:Z0s4QvfaEwjgw8HQD22wEoGkSIQtH8

    Score
    8/10
    discoverysteampersistencephishing

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Detected potential entity reuse from brand STEAM.

      phishingsteam
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks