Overview

overview

10

Static

static

8035a915e7...8a.exe

windows7_x64

10

8035a915e7...8a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8035a915e75f6190d976db518ffc0ff6c9585950584e2c8de6c5a2416f36958a

  • Size

    4.9MB

  • Sample

    220508-jn9rqsehbp

  • MD5

    81d472b1ad8873c3176bebf595c3fb2e

  • SHA1

    f6cc8fb9e7c0036af01bcf75f26c980204c5d828

  • SHA256

    8035a915e75f6190d976db518ffc0ff6c9585950584e2c8de6c5a2416f36958a

  • SHA512

    a4526ea17240482d6e9f07a47ecabd80fa7959364c5a041dcb3d2de50eaff7f6fac3c002ea5228da8306c3c5cf7021d4132c869a004e5095154ba72c1393ae75

Score
10/10
rmsdiscoveryevasionrattrojan

Malware Config

Targets

    • Target

      8035a915e75f6190d976db518ffc0ff6c9585950584e2c8de6c5a2416f36958a

    • Size

      4.9MB

    • MD5

      81d472b1ad8873c3176bebf595c3fb2e

    • SHA1

      f6cc8fb9e7c0036af01bcf75f26c980204c5d828

    • SHA256

      8035a915e75f6190d976db518ffc0ff6c9585950584e2c8de6c5a2416f36958a

    • SHA512

      a4526ea17240482d6e9f07a47ecabd80fa7959364c5a041dcb3d2de50eaff7f6fac3c002ea5228da8306c3c5cf7021d4132c869a004e5095154ba72c1393ae75

    Score
    10/10
    rmsdiscoveryevasionrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks