Overview

overview

10

Static

static

8

C1449224FE...85.exe

windows7_x64

10

C1449224FE...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C1449224FE94853D6FFE4665A33FF285.exe

  • Size

    17.4MB

  • Sample

    210723-vzg5kekd7n

  • MD5

    c1449224fe94853d6ffe4665a33ff285

  • SHA1

    00c1eed0f221fd5b1b4969718474876a253abb18

  • SHA256

    6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e

  • SHA512

    0f8bb805b2f0fc4574d2673c71551f6432f8786a62aa7d1cb05b943620c2d8af2b6b85194fbcee03e8e35268aee869f8c892d230db7834516f5e2e195f4fa5d5

Score
10/10
ruratbackdoordiscoverytrojanupx

Malware Config

Targets

    • Target

      C1449224FE94853D6FFE4665A33FF285.exe

    • Size

      17.4MB

    • MD5

      c1449224fe94853d6ffe4665a33ff285

    • SHA1

      00c1eed0f221fd5b1b4969718474876a253abb18

    • SHA256

      6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e

    • SHA512

      0f8bb805b2f0fc4574d2673c71551f6432f8786a62aa7d1cb05b943620c2d8af2b6b85194fbcee03e8e35268aee869f8c892d230db7834516f5e2e195f4fa5d5

    Score
    10/10
    ruratbackdoordiscoverytrojan

    • RuRAT

      RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.

      trojanbackdoorrurat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks