Overview

overview

10

Static

static

c0d9e52388...ea.exe

windows7_x64

10

c0d9e52388...ea.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0d9e5238842dd573f6f7042b08ed7e11cfc6fa0daef30a68c837e89816c3eea

  • Size

    4.2MB

  • Sample

    220128-w8k1bsaha4

  • MD5

    eaf87c7f8adf7bdcd2878ccb350676f9

  • SHA1

    beef0ee9397b01855c6daa2bff8002db4899b121

  • SHA256

    c0d9e5238842dd573f6f7042b08ed7e11cfc6fa0daef30a68c837e89816c3eea

  • SHA512

    b81481f05f0817085cf7f91b9a269e7723d653e50d34925dd422cf60e250212a76af6dfb95eb812ffc735d6e264cdf6fe953e41727a08c5f94b0b8ee9a68a650

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      c0d9e5238842dd573f6f7042b08ed7e11cfc6fa0daef30a68c837e89816c3eea

    • Size

      4.2MB

    • MD5

      eaf87c7f8adf7bdcd2878ccb350676f9

    • SHA1

      beef0ee9397b01855c6daa2bff8002db4899b121

    • SHA256

      c0d9e5238842dd573f6f7042b08ed7e11cfc6fa0daef30a68c837e89816c3eea

    • SHA512

      b81481f05f0817085cf7f91b9a269e7723d653e50d34925dd422cf60e250212a76af6dfb95eb812ffc735d6e264cdf6fe953e41727a08c5f94b0b8ee9a68a650

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks