General

  • Target

    AdobeSD.exe

  • Size

    4MB

  • Sample

    210301-1z271lvxve

  • MD5

    24cae17860a840c0317018ef3d607e94

  • SHA1

    7595283fd24ebae9f95ea80209d674ca9bd2afcc

  • SHA256

    7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c

  • SHA512

    bdfe1b899ef55a0ae793e672c190d79161899179d98b0577b5ceda8f02c66376ca0d366c0f087dbb043d30c7ec41a39b0cd2fcc6be4d66639777c6430db3ee82

Malware Config

Targets

    • Target

      AdobeSD.exe

    • Size

      4MB

    • MD5

      24cae17860a840c0317018ef3d607e94

    • SHA1

      7595283fd24ebae9f95ea80209d674ca9bd2afcc

    • SHA256

      7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c

    • SHA512

      bdfe1b899ef55a0ae793e672c190d79161899179d98b0577b5ceda8f02c66376ca0d366c0f087dbb043d30c7ec41a39b0cd2fcc6be4d66639777c6430db3ee82

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Stops running service(s)

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Modify Existing Service

1
T1031

Defense Evasion

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Impact

Service Stop

1
T1489

Tasks