Overview

overview

10

Static

static

d970b41099...3a.exe

windows7_x64

10

d970b41099...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d970b41099d916b86fce2da5574054f2fb7e42f386a5aefe9a9793071307ea3a

  • Size

    9.3MB

  • Sample

    220314-cmfnyadhcr

  • MD5

    974e935a91b133666e1cd10901d5cfaf

  • SHA1

    eabd2136a8870cba64e969fd5cedccf58d6c5b2c

  • SHA256

    d970b41099d916b86fce2da5574054f2fb7e42f386a5aefe9a9793071307ea3a

  • SHA512

    4964bb2ca9ebad86904fad3f8276bd239814a39392af6d61ef8bf2bdf7ca0c04f8aa6697ffe911bc367017f59813e2d2d3150d9b11fd12090619670660c12990

Score
10/10
rmsaspackv2evasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      d970b41099d916b86fce2da5574054f2fb7e42f386a5aefe9a9793071307ea3a

    • Size

      9.3MB

    • MD5

      974e935a91b133666e1cd10901d5cfaf

    • SHA1

      eabd2136a8870cba64e969fd5cedccf58d6c5b2c

    • SHA256

      d970b41099d916b86fce2da5574054f2fb7e42f386a5aefe9a9793071307ea3a

    • SHA512

      4964bb2ca9ebad86904fad3f8276bd239814a39392af6d61ef8bf2bdf7ca0c04f8aa6697ffe911bc367017f59813e2d2d3150d9b11fd12090619670660c12990

    Score
    10/10
    rmsaspackv2evasionpersistencerattrojanupx

    • Modifies system executable filetype association

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UAC bypass

      evasiontrojan

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks