Overview

overview

10

Static

static

26ccee6d3a...32.exe

windows7_x64

10

26ccee6d3a...32.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26ccee6d3a42db71b6618e6c16abd04cd32ade8ba2c01dcb6499081c2a0b3232

  • Size

    11.1MB

  • Sample

    220330-bsl78seah7

  • MD5

    7b23ce33315b00ef3040370f2d95c241

  • SHA1

    e9f081b941042ba9d78b3a481e5481005bab10ce

  • SHA256

    26ccee6d3a42db71b6618e6c16abd04cd32ade8ba2c01dcb6499081c2a0b3232

  • SHA512

    0650886745e3b36a320e6db62b7423368be9b45ef44ee47f6995ac8d14e3af5e33e7028b7687ca55d2067d3880cadf3624f5c7f13fa2c127c2a324874a6642d3

Score
10/10
rmspersistencerattrojanupx

Malware Config

Targets

    • Target

      26ccee6d3a42db71b6618e6c16abd04cd32ade8ba2c01dcb6499081c2a0b3232

    • Size

      11.1MB

    • MD5

      7b23ce33315b00ef3040370f2d95c241

    • SHA1

      e9f081b941042ba9d78b3a481e5481005bab10ce

    • SHA256

      26ccee6d3a42db71b6618e6c16abd04cd32ade8ba2c01dcb6499081c2a0b3232

    • SHA512

      0650886745e3b36a320e6db62b7423368be9b45ef44ee47f6995ac8d14e3af5e33e7028b7687ca55d2067d3880cadf3624f5c7f13fa2c127c2a324874a6642d3

    Score
    10/10
    rmspersistencerattrojanupx

    • Modifies WinLogon for persistence

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks