Overview

overview

10

Static

static

244ca178cb...cf.exe

windows7_x64

8

244ca178cb...cf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    244ca178cbb5116d9cde1375b6b9d95e74d1e24612f75c850e69724a6f1ad3cf

  • Size

    5.5MB

  • Sample

    220520-d8ybjsgbh7

  • MD5

    42f3db290bdb873ea53f87dd71262d41

  • SHA1

    97c643cee498989e193330f0af5b3d5a9d50977b

  • SHA256

    244ca178cbb5116d9cde1375b6b9d95e74d1e24612f75c850e69724a6f1ad3cf

  • SHA512

    2ced086d1488f1cda5d0dfbff9b30f1c838896f925bf615c71b26816ba43a2632f74d1da0880eccaf3b4793c3ad44b24063437285995d034d62751e9cc108841

Score
10/10
rmsevasionrattrojan

Malware Config

Targets

    • Target

      244ca178cbb5116d9cde1375b6b9d95e74d1e24612f75c850e69724a6f1ad3cf

    • Size

      5.5MB

    • MD5

      42f3db290bdb873ea53f87dd71262d41

    • SHA1

      97c643cee498989e193330f0af5b3d5a9d50977b

    • SHA256

      244ca178cbb5116d9cde1375b6b9d95e74d1e24612f75c850e69724a6f1ad3cf

    • SHA512

      2ced086d1488f1cda5d0dfbff9b30f1c838896f925bf615c71b26816ba43a2632f74d1da0880eccaf3b4793c3ad44b24063437285995d034d62751e9cc108841

    Score
    10/10
    evasionrmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks