Overview

overview

10

Static

static

7adfb53ec0...in.exe

windows7_x64

10

7adfb53ec0...in.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c.bin

  • Size

    5.0MB

  • Sample

    210225-cb5gl6kjr6

  • MD5

    24cae17860a840c0317018ef3d607e94

  • SHA1

    7595283fd24ebae9f95ea80209d674ca9bd2afcc

  • SHA256

    7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c

  • SHA512

    bdfe1b899ef55a0ae793e672c190d79161899179d98b0577b5ceda8f02c66376ca0d366c0f087dbb043d30c7ec41a39b0cd2fcc6be4d66639777c6430db3ee82

Score
10/10
rmsdiscoveryevasionrattrojan

Malware Config

Targets

    • Target

      7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c.bin

    • Size

      5.0MB

    • MD5

      24cae17860a840c0317018ef3d607e94

    • SHA1

      7595283fd24ebae9f95ea80209d674ca9bd2afcc

    • SHA256

      7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c

    • SHA512

      bdfe1b899ef55a0ae793e672c190d79161899179d98b0577b5ceda8f02c66376ca0d366c0f087dbb043d30c7ec41a39b0cd2fcc6be4d66639777c6430db3ee82

    Score
    10/10
    rmsdiscoveryevasionrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks