Overview
overview
5Static
static
5RWHack r1.2.03/rw.dll
windows10-2004-x64
5RWHack r1.2.03/rw.dll
windows11-21h2-x64
5RWHack r1.2.03/rw.exe
windows10-2004-x64
3RWHack r1.2.03/rw.exe
windows11-21h2-x64
3RWHack r1....hl.exe
windows10-2004-x64
5RWHack r1....hl.exe
windows11-21h2-x64
5RWHack r1....ld.dll
windows10-2004-x64
3RWHack r1....ld.dll
windows11-21h2-x64
3RWHack r1....mon.js
windows10-2004-x64
3RWHack r1....mon.js
windows11-21h2-x64
3RWHack r1....API.js
windows10-2004-x64
3RWHack r1....API.js
windows11-21h2-x64
3RWHack r1....SDK.js
windows10-2004-x64
3RWHack r1....SDK.js
windows11-21h2-x64
3RWHack r1....г.url
windows10-2004-x64
1RWHack r1....г.url
windows11-21h2-x64
1Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 11:48
Behavioral task
behavioral1
Sample
RWHack r1.2.03/rw.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
RWHack r1.2.03/rw.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
RWHack r1.2.03/rw.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
RWHack r1.2.03/rw.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
RWHack r1.2.03/rw.hl.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
RWHack r1.2.03/rw.hl.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
RWHack r1.2.03/stuff/CT-Shield 2/RW-Shield.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
RWHack r1.2.03/stuff/CT-Shield 2/RW-Shield.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Common.js
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Common.js
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_WinAPI.js
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_WinAPI.js
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_miniHLSDK.js
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/lua/Example_miniHLSDK.js
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/Читы для CS 1.6 ! Программы, Конфиг.url
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
RWHack r1.2.03/stuff/CT-Shield 2/rw-shield/Читы для CS 1.6 ! Программы, Конфиг.url
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target RWHack r1.2.03/rw.hl.exe
- Size 179KB
- Sample260511-nytkqab13k
- SHA256 88132922084d88a606d4430b1903c2c7d2b48e4b1467253c3a51ed00b05954c6
- MD5 12b9674d5a68f829f20214644e67baa3
- SHA1 9f2681173105f628c7cb14b57540121c5dc667dd
- SHA512 c1c47d6d7f2ec3d2cf6a50fe85acab653a4e81d7c56a2f1972f7de0b686272c3cb03f59be9512acb4530b94bbe90d4b81b00682d4413ed62bc69b6033a43a073
- SSDEEP 3072:O2qkbSLWyjCkRtc8lsAR8Z4GkZypFuX6HNwTBf0aeEus/aL:xH+ayW8fWOCDRY0ouAK
- TLSH T128044A89234AD90CD3D698FE6103E2348529D9350C63C2E1D7B63E3BEABAD516E570C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/3640-0-0x0000000000270000-0x00000000002CF000-memory.dmp upx behavioral6/memory/3640-2-0x0000000000270000-0x00000000002CF000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rw.hl.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe 3640 rw.hl.exe