Overview

overview

5

Static

static

5

RWHack r1.2.03/rw.dll

windows10-2004-x64

5

RWHack r1.2.03/rw.dll

windows11-21h2-x64

5

RWHack r1.2.03/rw.exe

windows10-2004-x64

3

RWHack r1.2.03/rw.exe

windows11-21h2-x64

3

RWHack r1....hl.exe

windows10-2004-x64

5

RWHack r1....hl.exe

windows11-21h2-x64

5

RWHack r1....ld.dll

windows10-2004-x64

3

RWHack r1....ld.dll

windows11-21h2-x64

3

RWHack r1....mon.js

windows10-2004-x64

3

RWHack r1....mon.js

windows11-21h2-x64

3

RWHack r1....API.js

windows10-2004-x64

3

RWHack r1....API.js

windows11-21h2-x64

3

RWHack r1....SDK.js

windows10-2004-x64

3

RWHack r1....SDK.js

windows11-21h2-x64

3

RWHack r1....г.url

windows10-2004-x64

1

RWHack r1....г.url

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    rwhack.rar
  • Size 6.6MB
  • Sample260511-nytkqab13k
  • SHA256 0031ff0e5c2831ad3855b3f1f0b2c698b0e9213f01357a9f55f44f401084b9f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryexecutionupx

Malware Config

Targets

    • Target
      RWHack r1.2.03/rw.dll
    • Size 195KB
    • SHA256 ca9164c73ae70511ee0d9b78a9e198796bfb0ad85c5cdfce0dd19bcf42dc1178
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      RWHack r1.2.03/rw.exe
    • Size 7KB
    • SHA256 9c6426decce1565e40d776c7ebcde56f8cb533902461b2b6d3eb8c1da3036946
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      RWHack r1.2.03/rw.hl.exe
    • Size 179KB
    • SHA256 88132922084d88a606d4430b1903c2c7d2b48e4b1467253c3a51ed00b05954c6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6
    • Target
      RWHack r1.2.03/stuff/CT-Shield 2/RW-Shield.asi
    • Size 1.3MB
    • SHA256 e9963a6f6776fb30c84ff3677b7a25e4946056fb47bcc183a79009760a09c77a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Common.lua
    • Size 2KB
    • SHA256 097cc4baf1f1d75e3b7f2bda9b091b0e53f362087b0562d71435e1943b28954e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_WinAPI.lua
    • Size 7KB
    • SHA256 17d65e4fadf617ee62ff9fe01dab15a7ae9c915a9cf781632a4e0a0735ff90a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_miniHLSDK.lua
    • Size 45KB
    • SHA256 631130f942c14e1122278f129176ee6480eab21a0dba6dd414a3a75f336c2ee4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/Читы для CS 1.6 ! Программы, Конфиги, Скрипты, Чит-плагины и т.д.URL
    • Size 51B
    • SHA256 44456275d987ac455af888e328118900b15554680452f44e08071ffd0d7af935
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v16

Tasks