General

  • Target

    1900FF6E192B9C247C0CE261B0D99D72BCFD9AF9C8A94.exe

  • Size

    4.2MB

  • Sample

    211107-t7nnqaaeh8

  • MD5

    c9bfc737cb069c9222294a25160ba101

  • SHA1

    1f56085421306ccfdcf26604f43662e1aec9cddc

  • SHA256

    1900ff6e192b9c247c0ce261b0d99d72bcfd9af9c8a94f2b0e88871a76eb662e

  • SHA512

    af13ca1dd9cc4c9833bf22fd766e6962eb9662dd2e2403b7dfff5f35670e5d71c1e7b5f348fac121f173ee9238cbaa05200dc3c334f16f508fb955019b8d28ea

Malware Config

Targets

    • Target

      1900FF6E192B9C247C0CE261B0D99D72BCFD9AF9C8A94.exe

    • Size

      4.2MB

    • MD5

      c9bfc737cb069c9222294a25160ba101

    • SHA1

      1f56085421306ccfdcf26604f43662e1aec9cddc

    • SHA256

      1900ff6e192b9c247c0ce261b0d99d72bcfd9af9c8a94f2b0e88871a76eb662e

    • SHA512

      af13ca1dd9cc4c9833bf22fd766e6962eb9662dd2e2403b7dfff5f35670e5d71c1e7b5f348fac121f173ee9238cbaa05200dc3c334f16f508fb955019b8d28ea

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks