Overview

overview

10

Static

static

SetupWallet.exe

windows7_x64

10

SetupWallet.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6aaa202c84a30b41d1d01ae6c94a73dd4ab92af7f9665d543493258e7a61fdd

  • Size

    6.3MB

  • Sample

    220317-bvrkqsgcen

  • MD5

    d98a51a38482e2e20d83f2d84652cffa

  • SHA1

    dc4d662ef45bc42bf9b0af0b187a0452cd8c67b8

  • SHA256

    c6aaa202c84a30b41d1d01ae6c94a73dd4ab92af7f9665d543493258e7a61fdd

  • SHA512

    c7e395be7d1b2679f86eba1757a436f4f9e8d200be4270d75934d8c9332d30e33def8c874481ddd7a36f9f19da1c5a5cfa1d67a3405fbd4feae854b137590250

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      SetupWallet.bin

    • Size

      6.8MB

    • MD5

      5ed4af2f49c3a4766bd4094209a3a030

    • SHA1

      42d0072de6ed12bd605a0362cbe2330c69a93d88

    • SHA256

      65526a403bca2df4dbcbb9997a8d012d6910ffe02342d790e5209eeb339d1027

    • SHA512

      6f238ddb43316e3cc9352caab9103f447938d500db2fa5d074bbdc1d76958306839b6fed352517e9d5d4b861ac14dbb4bdd313c8b94a791b58208d2f328f26fe

    Score
    10/10
    rmspersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks