Overview

overview

7

Static

static

3

r6external.exe

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    r6external.exe
  • Size 3.9MB
  • Sample261023-1yattsd19t
  • SHA256 83bba83ac9052ee929b7e4337f62d385d4194c417f8711d16c24605a98d39a0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Targets

    • Target
      r6external.exe
    • Size 3.9MB
    • SHA256 83bba83ac9052ee929b7e4337f62d385d4194c417f8711d16c24605a98d39a0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasion

    • Executes a file named after a Windows system binary

      The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

      defense_evasion

    • Executes dropped EXE

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks