Overview

overview

10

Static

static

fe580d1ff6...c9.exe

windows7_x64

10

fe580d1ff6...c9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe580d1ff6731875a28c8c9370749aef80cc7ae1cf40d9a656148e00ecf3f5c9

  • Size

    4.2MB

  • Sample

    220128-2l9m3afgf5

  • MD5

    550e089b4fea8f8b15ad71f8b6561b1d

  • SHA1

    032884a46430039ed4e38518aa20742b79ab2678

  • SHA256

    fe580d1ff6731875a28c8c9370749aef80cc7ae1cf40d9a656148e00ecf3f5c9

  • SHA512

    2e727d18480aaa9287c91bdeb5f9c58b2642ac3fffde8ca0b144daf7818ec8c1fa57baa22052a64a455f69ad91e773e1c72de79b9c2720f2eba0405565b67464

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      fe580d1ff6731875a28c8c9370749aef80cc7ae1cf40d9a656148e00ecf3f5c9

    • Size

      4.2MB

    • MD5

      550e089b4fea8f8b15ad71f8b6561b1d

    • SHA1

      032884a46430039ed4e38518aa20742b79ab2678

    • SHA256

      fe580d1ff6731875a28c8c9370749aef80cc7ae1cf40d9a656148e00ecf3f5c9

    • SHA512

      2e727d18480aaa9287c91bdeb5f9c58b2642ac3fffde8ca0b144daf7818ec8c1fa57baa22052a64a455f69ad91e773e1c72de79b9c2720f2eba0405565b67464

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks