Overview

overview

10

Static

static

ef4930fc91...0d.msi

windows7_x64

10

ef4930fc91...0d.msi

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d

  • Size

    3.6MB

  • Sample

    220128-v5sqbshfe8

  • MD5

    bdbb71848ccda557b6be1f1ef6f8386c

  • SHA1

    1db41ab648efdb58fafba6494b9fc89a7c15dadb

  • SHA256

    ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d

  • SHA512

    dc63a6536d61a463fb93954e2c309adce3308102c1b58c50b855ab99fbe4d2f7a02f9d85ef2184986f6cc70b5de1015148f0b05069a619886c34722072259688

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d

    • Size

      3.6MB

    • MD5

      bdbb71848ccda557b6be1f1ef6f8386c

    • SHA1

      1db41ab648efdb58fafba6494b9fc89a7c15dadb

    • SHA256

      ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d

    • SHA512

      dc63a6536d61a463fb93954e2c309adce3308102c1b58c50b855ab99fbe4d2f7a02f9d85ef2184986f6cc70b5de1015148f0b05069a619886c34722072259688

    Score
    10/10
    rmspersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks