Overview

overview

10

Static

static

RASClient-x64.msi

windows10_x64

10

Resubmissions

02/05/2023, 21:13

230502-z2yjmace97 8

20/02/2022, 17:23

220220-vya7pscgbk 10

14/11/2021, 04:08

211114-eqn6lacham 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    RASClient-x64.msi

  • Size

    34.6MB

  • Sample

    211114-eqn6lacham

  • MD5

    27fc803bd3e56f63f9dfbee16ab3b852

  • SHA1

    f597d569cb4c1aa9ee2c29bbcaff3fa9def01c10

  • SHA256

    ea104069fc5ac1fad61a51473ab875fa0a75866576d969ad6b6332bc5b8c4271

  • SHA512

    537aff6ef9c54c0963211e5eae03c637a55c008f22e4ac977bc79b2e0644942f7c11d33a902ec47ba95bfd16f3b6f2cc902f4f3f0464f6dcc11f32b263a9fa85

Score
10/10
persistence

Malware Config

Targets

    • Target

      RASClient-x64.msi

    • Size

      34.6MB

    • MD5

      27fc803bd3e56f63f9dfbee16ab3b852

    • SHA1

      f597d569cb4c1aa9ee2c29bbcaff3fa9def01c10

    • SHA256

      ea104069fc5ac1fad61a51473ab875fa0a75866576d969ad6b6332bc5b8c4271

    • SHA512

      537aff6ef9c54c0963211e5eae03c637a55c008f22e4ac977bc79b2e0644942f7c11d33a902ec47ba95bfd16f3b6f2cc902f4f3f0464f6dcc11f32b263a9fa85

    Score
    10/10
    persistence

    • Registers COM server for autorun

      persistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks