Overview

overview

10

Static

static

8

Елект...в.exe

windows7_x64

10

Елект...в.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Електронний запит документів.exe

  • Size

    20.4MB

  • Sample

    210303-qxaap59azj

  • MD5

    f3cd5dcafeee267f25f3f906a6e9a817

  • SHA1

    8b40cc3af82d6448a53135cd5ba67698f26f31f4

  • SHA256

    7a986db7a9d76e881ade9ffa143ba36a84808c7e29dfc3ead49241b00a61637e

  • SHA512

    9e35977ed0e4f2d0674a1e5f164b6c3322035f450a39b0dedddd5f8e198976e0ec85754e33782e96489a99411444c4e8614063ad37e7cb7b5470ed5a78f39b93

Score
10/10
ruratbackdoordiscoverytrojanupx

Malware Config

Targets

    • Target

      Електронний запит документів.exe

    • Size

      20.4MB

    • MD5

      f3cd5dcafeee267f25f3f906a6e9a817

    • SHA1

      8b40cc3af82d6448a53135cd5ba67698f26f31f4

    • SHA256

      7a986db7a9d76e881ade9ffa143ba36a84808c7e29dfc3ead49241b00a61637e

    • SHA512

      9e35977ed0e4f2d0674a1e5f164b6c3322035f450a39b0dedddd5f8e198976e0ec85754e33782e96489a99411444c4e8614063ad37e7cb7b5470ed5a78f39b93

    Score
    10/10
    ruratbackdoordiscoverytrojan

    • RuRAT

      RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.

      trojanbackdoorrurat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks