rurat

General

Target
до судового запиту.docx.exe
Size 20.6MB
Sample210809-hl3vm1w22n
SHA256 e780d9132b814b9ee7514918da9badd98afc454a01bb5233e13e0db8f192e888
MD5 d7084b169082cd511badf160d4f74c33
SHA1 6ab02d048b706167808e98bbda4a86367ab26f6f
SHA512 c562710f56b0b4a6900edc1f14c7b3e7541976e5c31af81a70b41e237ecd6bfd7f7d78054e49481073fb2f39a316bd3f7257a13291351861992cb05ce395f03f
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  до судового запиту.docx.exe
- Size 20.6MB
- SHA256 e780d9132b814b9ee7514918da9badd98afc454a01bb5233e13e0db8f192e888
- MD5 d7084b169082cd511badf160d4f74c33
- SHA1 6ab02d048b706167808e98bbda4a86367ab26f6f
- SHA512 c562710f56b0b4a6900edc1f14c7b3e7541976e5c31af81a70b41e237ecd6bfd7f7d78054e49481073fb2f39a316bd3f7257a13291351861992cb05ce395f03f
- MD5 SHA1 SHA512
Score

10^/10

rurat backdoor discovery trojan upx
- RuRAT
  RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
  trojan backdoor rurat
- Blocklisted process makes network request
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

5

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2