Overview

overview

10

Static

static

bf4182178b...ec.exe

windows7_x64

10

bf4182178b...ec.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf4182178ba2625f04c85d52f97fa88c4cfb15e7161f0343b056efc84ddf5eec

  • Size

    4.0MB

  • Sample

    220128-w781rsagh7

  • MD5

    8721701be0cdc7029182765f1612ee6c

  • SHA1

    855a9d88478538751e5a6cea832a0ddbcb60e308

  • SHA256

    bf4182178ba2625f04c85d52f97fa88c4cfb15e7161f0343b056efc84ddf5eec

  • SHA512

    c35fcd56894c80f36a492fab2fc44ec5574f14ab4d99f5dd8eddee12ec58498fe1d2ce2e18684cbfd33f3c7c11630111aaf9cd410ea6a7251c803758185fea20

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      bf4182178ba2625f04c85d52f97fa88c4cfb15e7161f0343b056efc84ddf5eec

    • Size

      4.0MB

    • MD5

      8721701be0cdc7029182765f1612ee6c

    • SHA1

      855a9d88478538751e5a6cea832a0ddbcb60e308

    • SHA256

      bf4182178ba2625f04c85d52f97fa88c4cfb15e7161f0343b056efc84ddf5eec

    • SHA512

      c35fcd56894c80f36a492fab2fc44ec5574f14ab4d99f5dd8eddee12ec58498fe1d2ce2e18684cbfd33f3c7c11630111aaf9cd410ea6a7251c803758185fea20

    Score
    10/10
    rmspersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks