Overview

overview

10

Static

static

c52b5f0cea...9d.exe

windows7_x64

10

c52b5f0cea...9d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d

  • Size

    6.8MB

  • Sample

    220415-e38e1adffr

  • MD5

    fb95de0cc4413a25e6d53fa25c3c5c0e

  • SHA1

    bfd95642630d2f43c74839e3bef6d39e84a911d0

  • SHA256

    c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d

  • SHA512

    6c40a58313f63ff0f362211ea17dee5264af2139e2c0995a1f249e7f30ac21249c9d0fdb778e2ab2df30d2faa6815e4d85fd376fbf65c25fd32e6751146ff4c6

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d

    • Size

      6.8MB

    • MD5

      fb95de0cc4413a25e6d53fa25c3c5c0e

    • SHA1

      bfd95642630d2f43c74839e3bef6d39e84a911d0

    • SHA256

      c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d

    • SHA512

      6c40a58313f63ff0f362211ea17dee5264af2139e2c0995a1f249e7f30ac21249c9d0fdb778e2ab2df30d2faa6815e4d85fd376fbf65c25fd32e6751146ff4c6

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks