Overview

overview

10

Static

static

36329712a2...16.exe

windows7_x64

10

36329712a2...16.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216

  • Size

    4.2MB

  • Sample

    220128-z82vmaeda5

  • MD5

    946142c3d34b736bbc890fa64ae09efe

  • SHA1

    421f52733d334be32c899670426c06cb72d92cde

  • SHA256

    36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216

  • SHA512

    e9088eea723f732ba1a19ee1d81b09b0c5e3442a6c8cd2f537c86060548acb936bdcfa4c14ecde34a223bd72ed3776c887691af2afa781950a26181b13906d54

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216

    • Size

      4.2MB

    • MD5

      946142c3d34b736bbc890fa64ae09efe

    • SHA1

      421f52733d334be32c899670426c06cb72d92cde

    • SHA256

      36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216

    • SHA512

      e9088eea723f732ba1a19ee1d81b09b0c5e3442a6c8cd2f537c86060548acb936bdcfa4c14ecde34a223bd72ed3776c887691af2afa781950a26181b13906d54

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks