Overview

overview

10

Static

static

4c9f119fa1...27.exe

windows7_x64

10

4c9f119fa1...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427

  • Size

    4.6MB

  • Sample

    220310-yqfzrsdhep

  • MD5

    db463e26728b4396feb9145ef2de758d

  • SHA1

    e10a452585645cde52d8e20db93dfa935290f28d

  • SHA256

    4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427

  • SHA512

    e8d9afc3cc3d3a43d35eda30f761e9bb2ceedc2a1f9edcd0b7f8631313129f2d730deb9bcdbed9d881da3c6c41c52cdcba9a721fbd05d4b4266fb3bdfce2e309

Score
10/10
rmsdiscoveryevasionrattrojanupx

Malware Config

Targets

    • Target

      4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427

    • Size

      4.6MB

    • MD5

      db463e26728b4396feb9145ef2de758d

    • SHA1

      e10a452585645cde52d8e20db93dfa935290f28d

    • SHA256

      4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427

    • SHA512

      e8d9afc3cc3d3a43d35eda30f761e9bb2ceedc2a1f9edcd0b7f8631313129f2d730deb9bcdbed9d881da3c6c41c52cdcba9a721fbd05d4b4266fb3bdfce2e309

    Score
    10/10
    rmsdiscoveryevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks