Overview

overview

10

Static

static

9d3bd35fb7...79.exe

windows7_x64

10

9d3bd35fb7...79.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379

  • Size

    4.1MB

  • Sample

    220427-rwlc4shcg9

  • MD5

    cf430d5f775e4a32801e55af43db9bbb

  • SHA1

    f2faf3d9fbbfbaf5296da25af0c7b37ff26a858c

  • SHA256

    9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379

  • SHA512

    aa49f98c13ff17f0b2060f02cfe5d33518679bacb39bab7ddd20c9c4d3a302b941a39505db19dc96c46f71da74832bb57f6e783dbc687da2d2caf841643d90bb

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379

    • Size

      4.1MB

    • MD5

      cf430d5f775e4a32801e55af43db9bbb

    • SHA1

      f2faf3d9fbbfbaf5296da25af0c7b37ff26a858c

    • SHA256

      9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379

    • SHA512

      aa49f98c13ff17f0b2060f02cfe5d33518679bacb39bab7ddd20c9c4d3a302b941a39505db19dc96c46f71da74832bb57f6e783dbc687da2d2caf841643d90bb

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks