General

  • Target

    9138077c72187bf72604a20c261245b0fff8fb389277d2f82eacc59949ec8878

  • Size

    14.6MB

  • Sample

    220128-yctzgabgfk

  • MD5

    c7ae7d0624701f1913d302bb38dc4237

  • SHA1

    ec888f5ee0159d6b2c05023ea4f22850f8e056aa

  • SHA256

    9138077c72187bf72604a20c261245b0fff8fb389277d2f82eacc59949ec8878

  • SHA512

    17d62b94bc9a1e8bd91c5dbc7dd88920851f4be65b196dac1bc1f9278607f97be0ee7198819597e5763a085d48cbe312c5a3dda73ca23767f43c155f936a0b14

Score
10/10

Malware Config

Targets

    • Target

      9138077c72187bf72604a20c261245b0fff8fb389277d2f82eacc59949ec8878

    • Size

      14.6MB

    • MD5

      c7ae7d0624701f1913d302bb38dc4237

    • SHA1

      ec888f5ee0159d6b2c05023ea4f22850f8e056aa

    • SHA256

      9138077c72187bf72604a20c261245b0fff8fb389277d2f82eacc59949ec8878

    • SHA512

      17d62b94bc9a1e8bd91c5dbc7dd88920851f4be65b196dac1bc1f9278607f97be0ee7198819597e5763a085d48cbe312c5a3dda73ca23767f43c155f936a0b14

    Score
    10/10
    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • UAC bypass

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks