General

  • Target

    8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

  • Size

    4.2MB

  • Sample

    220417-sa4g8sgfbj

  • MD5

    222ed21454fe20b7b03ddfdea73f38af

  • SHA1

    a96bcb7230d6b1898047a0b39a6dc6d2654d0a42

  • SHA256

    8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

  • SHA512

    f2221af308723a0ecdc85196733bed7c52d5d2369b9ec11c095c96f82875521856c0e402814240467da8df0bf1b40ef7e7d5faae27f58a83d66cd9fd98dd81f0

Malware Config

Targets

    • Target

      8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

    • Size

      4.2MB

    • MD5

      222ed21454fe20b7b03ddfdea73f38af

    • SHA1

      a96bcb7230d6b1898047a0b39a6dc6d2654d0a42

    • SHA256

      8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

    • SHA512

      f2221af308723a0ecdc85196733bed7c52d5d2369b9ec11c095c96f82875521856c0e402814240467da8df0bf1b40ef7e7d5faae27f58a83d66cd9fd98dd81f0

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks