Overview

overview

10

Static

static

8

289B352912...10.exe

windows7_x64

10

289B352912...10.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    289B352912C056D7BD1D91559077AC10.exe

  • Size

    20.4MB

  • Sample

    210503-c4z9srde9e

  • MD5

    289b352912c056d7bd1d91559077ac10

  • SHA1

    a02168ec4b6c33b0752efa78789e129f0df695ed

  • SHA256

    42751b51dda214051e76da0bdcd07d05a0ea06a7e5f8e1ff6972cbd20a5d6dfd

  • SHA512

    89fff63fa5bb3d12dfe9bbe6f39bc71ad444c13dee7037bb0fa991f9eac425316d7ee0866cacd5b02f260a395e30136c997c89081ba806c3d2801e1213b7b38a

Score
10/10
ruratbackdoordiscoverytrojanupx

Malware Config

Targets

    • Target

      289B352912C056D7BD1D91559077AC10.exe

    • Size

      20.4MB

    • MD5

      289b352912c056d7bd1d91559077ac10

    • SHA1

      a02168ec4b6c33b0752efa78789e129f0df695ed

    • SHA256

      42751b51dda214051e76da0bdcd07d05a0ea06a7e5f8e1ff6972cbd20a5d6dfd

    • SHA512

      89fff63fa5bb3d12dfe9bbe6f39bc71ad444c13dee7037bb0fa991f9eac425316d7ee0866cacd5b02f260a395e30136c997c89081ba806c3d2801e1213b7b38a

    Score
    10/10
    ruratbackdoordiscoverytrojan

    • RuRAT

      RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.

      trojanbackdoorrurat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks