rms | 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/04/2022, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe
Size 4.2MB
Sample220417-sa4g8sgfbj
SHA256 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6
MD5 222ed21454fe20b7b03ddfdea73f38af
SHA1 a96bcb7230d6b1898047a0b39a6dc6d2654d0a42
SHA512 f2221af308723a0ecdc85196733bed7c52d5d2369b9ec11c095c96f82875521856c0e402814240467da8df0bf1b40ef7e7d5faae27f58a83d66cd9fd98dd81f0
MD5 SHA1 SHA512

Score

10^/10

rms discovery evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 9 IoCs

pid	Process
2160	done.sfx.exe
4940	done.exe
532	rutserv.exe
2944	rutserv.exe
4512	rutserv.exe
4344	rutserv.exe
3980	rfusclient.exe
2744	rfusclient.exe
2044	rfusclient.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231d4-146.dat	upx
behavioral2/files/0x00060000000231d3-145.dat	upx
behavioral2/files/0x00060000000231d8-155.dat	upx
behavioral2/files/0x00060000000231d8-151.dat	upx
behavioral2/files/0x00070000000231cd-150.dat	upx
behavioral2/files/0x00060000000231d8-157.dat	upx
behavioral2/files/0x00060000000231d8-159.dat	upx
behavioral2/files/0x00060000000231d8-160.dat	upx
behavioral2/files/0x00070000000231cd-164.dat	upx
behavioral2/files/0x00070000000231cd-163.dat	upx
behavioral2/files/0x00070000000231cd-166.dat	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	done.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	done.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rutserv.pdb	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\exe\rutserv.pdb	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\rutserv.pdb	rutserv.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\rtsd\rfusclient.exe	cmd.exe
File created	C:\Program Files\rtsd\vp8encoder.dll	cmd.exe
File opened for modification	C:\Program Files\rtsd\rutserv.pdb	rutserv.exe
File opened for modification	C:\Program Files\rtsd\rutserv.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\install.bat	done.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\regedit.reg	done.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\rfusclient.exe	done.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\vp8decoder.dll	done.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\vp8encoder.dll	done.exe
File opened for modification	C:\Program Files\rtsd\vp8decoder.dll	attrib.exe
File opened for modification	C:\Program Files\rtsd\vp8encoder.dll	cmd.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\rutserv.exe	done.exe
File opened for modification	C:\Program Files (x86)\Skype\Skype\Uninstall.exe	done.exe
File created	C:\Program Files (x86)\Skype\Skype\Uninstall.ini	done.exe
File opened for modification	C:\Program Files\rtsd\rfusclient.exe	cmd.exe
File created	C:\Program Files\rtsd\rutserv.exe	cmd.exe
File created	C:\Program Files\rtsd\vp8decoder.dll	cmd.exe
File opened for modification	C:\Program Files\rtsd\vp8decoder.dll	cmd.exe
File opened for modification	C:\Program Files\rtsd\rfusclient.exe	attrib.exe
File opened for modification	C:\Program Files\rtsd\rutserv.exe	attrib.exe
File opened for modification	C:\Program Files\rtsd\vp8encoder.dll	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
4492	taskkill.exe
4144	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4464	regedit.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
532	rutserv.exe
532	rutserv.exe
532	rutserv.exe
532	rutserv.exe
532	rutserv.exe
532	rutserv.exe
2944	rutserv.exe
2944	rutserv.exe
4512	rutserv.exe
4512	rutserv.exe
4344	rutserv.exe
4344	rutserv.exe
4344	rutserv.exe
4344	rutserv.exe
4344	rutserv.exe
4344	rutserv.exe
2744	rfusclient.exe
2744	rfusclient.exe

Suspicious behavior: SetClipboardViewer 3 IoCs

pid	Process
3980	rfusclient.exe
3980	rfusclient.exe
2044	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeDebugPrivilege	532	rutserv.exe
Token: SeDebugPrivilege	4512	rutserv.exe
Token: SeTakeOwnershipPrivilege	4344	rutserv.exe
Token: SeTcbPrivilege	4344	rutserv.exe
Token: SeTcbPrivilege	4344	rutserv.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4940	done.exe
532	rutserv.exe
532	rutserv.exe
2944	rutserv.exe
2944	rutserv.exe
4512	rutserv.exe
4512	rutserv.exe
4344	rutserv.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3344	1648	8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe	78
PID 1648 wrote to memory of 3344	1648	8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe	78
PID 1648 wrote to memory of 3344	1648	8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe	78
PID 3344 wrote to memory of 2160	3344	cmd.exe	81
PID 3344 wrote to memory of 2160	3344	cmd.exe	81
PID 3344 wrote to memory of 2160	3344	cmd.exe	81
PID 2160 wrote to memory of 4940	2160	done.sfx.exe	82
PID 2160 wrote to memory of 4940	2160	done.sfx.exe	82
PID 2160 wrote to memory of 4940	2160	done.sfx.exe	82
PID 4940 wrote to memory of 4532	4940	done.exe	83
PID 4940 wrote to memory of 4532	4940	done.exe	83
PID 4940 wrote to memory of 4532	4940	done.exe	83
PID 4532 wrote to memory of 4492	4532	cmd.exe	84
PID 4532 wrote to memory of 4492	4532	cmd.exe	84
PID 4532 wrote to memory of 4492	4532	cmd.exe	84
PID 4532 wrote to memory of 4144	4532	cmd.exe	87
PID 4532 wrote to memory of 4144	4532	cmd.exe	87
PID 4532 wrote to memory of 4144	4532	cmd.exe	87
PID 4532 wrote to memory of 4568	4532	cmd.exe	89
PID 4532 wrote to memory of 4568	4532	cmd.exe	89
PID 4532 wrote to memory of 4568	4532	cmd.exe	89
PID 4532 wrote to memory of 4464	4532	cmd.exe	90
PID 4532 wrote to memory of 4464	4532	cmd.exe	90
PID 4532 wrote to memory of 4464	4532	cmd.exe	90
PID 4532 wrote to memory of 1728	4532	cmd.exe	91
PID 4532 wrote to memory of 1728	4532	cmd.exe	91
PID 4532 wrote to memory of 1728	4532	cmd.exe	91
PID 4532 wrote to memory of 532	4532	cmd.exe	92
PID 4532 wrote to memory of 532	4532	cmd.exe	92
PID 4532 wrote to memory of 532	4532	cmd.exe	92
PID 4532 wrote to memory of 2944	4532	cmd.exe	93
PID 4532 wrote to memory of 2944	4532	cmd.exe	93
PID 4532 wrote to memory of 2944	4532	cmd.exe	93
PID 4532 wrote to memory of 4512	4532	cmd.exe	94
PID 4532 wrote to memory of 4512	4532	cmd.exe	94
PID 4532 wrote to memory of 4512	4532	cmd.exe	94
PID 4344 wrote to memory of 3980	4344	rutserv.exe	99
PID 4344 wrote to memory of 3980	4344	rutserv.exe	99
PID 4344 wrote to memory of 3980	4344	rutserv.exe	99
PID 4344 wrote to memory of 2744	4344	rutserv.exe	98
PID 4344 wrote to memory of 2744	4344	rutserv.exe	98
PID 4344 wrote to memory of 2744	4344	rutserv.exe	98
PID 2744 wrote to memory of 2044	2744	rfusclient.exe	100
PID 2744 wrote to memory of 2044	2744	rfusclient.exe	100
PID 2744 wrote to memory of 2044	2744	rfusclient.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1728	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe
"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
    done.sfx.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\done.exe
      "C:\Users\Admin\AppData\Local\Temp\done.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skype\Skype\install.bat" "
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4532
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im 4t4t5
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im g4rgt
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "70t9j" /f
        6⤵
        
        PID:4568
      - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "regedit.reg"
        6⤵
        Runs .reg file with regedit
        
        PID:4464
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Program Files\rtsd\*.*"
        6⤵
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:1728
      - C:\Program Files\rtsd\rutserv.exe
        
        rutserv.exe /silentinstall
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Program Files\rtsd\rutserv.exe
        
        rutserv.exe /firewall
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Program Files\rtsd\rutserv.exe
        
        rutserv.exe /start
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4512

C:\Program Files\rtsd\rutserv.exe
"C:\Program Files\rtsd\rutserv.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files\rtsd\rfusclient.exe
  "C:\Program Files\rtsd\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files\rtsd\rfusclient.exe
    "C:\Program Files\rtsd\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:2044
- C:\Program Files\rtsd\rfusclient.exe
  "C:\Program Files\rtsd\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: SetClipboardViewer
  PID:3980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Program Files (x86)\Skype\Skype\install.bat
Size 884B
SHA256 db1602d244bad54475174194204f4604804094c8156b8ea2b1dc81879be8ac92
MD5 fd6bef56a5dc776691926eb3aa7b5279
SHA1 da94eb0f6ca09850decb74326fe7894253dfec6c
SHA512 3694350a2efaece3664c96327f0fc6cb77a87d68313a3011824953650b9afc40d19b2db1743dbbd317a223d5463c7a8eae1518a9b1e417226e930a941c7f830c
MD5 SHA1 SHA512

Submit Download

regedit.reg

Path C:\Program Files (x86)\Skype\Skype\regedit.reg
Size 12KB
SHA256 49525765484a492bdc74a26bf2baf5f2dda6907dc1866ca80bd3d97c1177fd4d
MD5 be9eab82e90b682ee82da98a7c77fede
SHA1 d1ac691345dc42dc253c441e92f4e54e74135451
SHA512 047aa0866e1c4c64ddbda3621741a117f6ce3f2cfb25dee275af26ac398d1af2148d4f068ddb84105215b52bd44932d72b6469c06a1c390a35edbd1768718204
SSDEEP 192:PS1BNfWIhg7o3frQ/UJ53sGnVKDUnQbwCUuq+3V:PC/q76frnRsKnQbwCUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Skype\Skype\rfusclient.exe
Size 1.5MB
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
SSDEEP 24576:L09RnoRoHfVxwl1blBBLFNsir4FbQ6G48V6l3AP7151InLAfhM+w+V:AE6Hd2BkTFNGKlQPyWh3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Skype\Skype\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Skype\Skype\vp8decoder.dll
Size 378KB
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
SSDEEP 6144:QIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcT:QI8tiDOzyH9H8Tu6h04fZMZoMPuvfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Skype\Skype\vp8encoder.dll
Size 1.6MB
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
SSDEEP 49152:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Program Files\rtsd\rfusclient.exe
Size 1.5MB
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
SSDEEP 24576:L09RnoRoHfVxwl1blBBLFNsir4FbQ6G48V6l3AP7151InLAfhM+w+V:AE6Hd2BkTFNGKlQPyWh3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Program Files\rtsd\rfusclient.exe
Size 1.5MB
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
SSDEEP 24576:L09RnoRoHfVxwl1blBBLFNsir4FbQ6G48V6l3AP7151InLAfhM+w+V:AE6Hd2BkTFNGKlQPyWh3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Program Files\rtsd\rfusclient.exe
Size 1.5MB
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
SSDEEP 24576:L09RnoRoHfVxwl1blBBLFNsir4FbQ6G48V6l3AP7151InLAfhM+w+V:AE6Hd2BkTFNGKlQPyWh3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Program Files\rtsd\rfusclient.exe
Size 1.5MB
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
SSDEEP 24576:L09RnoRoHfVxwl1blBBLFNsir4FbQ6G48V6l3AP7151InLAfhM+w+V:AE6Hd2BkTFNGKlQPyWh3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files\rtsd\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files\rtsd\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files\rtsd\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files\rtsd\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Program Files\rtsd\rutserv.exe
Size 1.8MB
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
SSDEEP 24576:CA539fwllXYv/Nrq7zTS7LnwYcZnvMv3yme06/ivX6oqkNYKWB+puidQ2mo02sFY:jweqWDtvC8b6o3zhvmo02sFNKxJErs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Program Files\rtsd\vp8decoder.dll
Size 378KB
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
SSDEEP 6144:QIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcT:QI8tiDOzyH9H8Tu6h04fZMZoMPuvfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Program Files\rtsd\vp8encoder.dll
Size 1.6MB
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
SSDEEP 49152:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Start.bat

Path C:\Users\Admin\AppData\Local\Temp\Start.bat
Size 29B
SHA256 33a1a9c8075a826cf9af1bea7bbde3bcdc359a59104556df73004d31e6e81510
MD5 5c2579116c93e93aa51120f9e5c7832f
SHA1 8716bb82b326d4c4d1d0d459591e34cebe7452bf
SHA512 272943f8efe1e93761d5d063bf5c92a15dbc34621df19bb679daf18f0ece66ee2844385a9b95283ebbbafce9f5d5ba7012792393eb886b704f123a4d65c74360
MD5 SHA1 SHA512

Submit Download

done.exe

Path C:\Users\Admin\AppData\Local\Temp\done.exe
Size 3.9MB
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
SSDEEP 98304:pAI+VV23ekB4PJyQEtiyn6OP50erQGijhXH:itZkBLJvP5prnijB
MD5 SHA1 SHA512 SSDEEP

Submit Download

done.exe

Path C:\Users\Admin\AppData\Local\Temp\done.exe
Size 3.9MB
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
SSDEEP 98304:pAI+VV23ekB4PJyQEtiyn6OP50erQGijhXH:itZkBLJvP5prnijB
MD5 SHA1 SHA512 SSDEEP

Submit Download

done.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
Size 4.1MB
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7
SSDEEP 98304:gOxjOiEibRIv6MyFSW7sfWVMLwKQcGQaUg5ZW6xZOC6prQ:g0KIRwG0WF0/DITWU
MD5 SHA1 SHA512 SSDEEP

Submit Download

done.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
Size 4.1MB
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7
SSDEEP 98304:gOxjOiEibRIv6MyFSW7sfWVMLwKQcGQaUg5ZW6xZOC6prQ:g0KIRwG0WF0/DITWU
MD5 SHA1 SHA512 SSDEEP

Submit Download