Overview

overview

10

Static

static

7fc961edbd...f5.exe

windows7_x64

10

7fc961edbd...f5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fc961edbd47040dbe29241d252478847ebbf8554db3e197e909c36e17cd56f5

  • Size

    4.3MB

  • Sample

    220523-1agx8shah4

  • MD5

    1a3a539d46d864a5c10bbe55150e03f3

  • SHA1

    8d2d3d4dfe96b4c8fc62264a22bdd289749f0756

  • SHA256

    7fc961edbd47040dbe29241d252478847ebbf8554db3e197e909c36e17cd56f5

  • SHA512

    3504e27c5a6b2e0bc8fa8cf39ef1225df6ef9be6be0bb874d0ebed5dbf4296cd9b9056e018ee5a76067495fcf410b43a16b1d84f1f4e7aa65dac501f9c5c2908

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      7fc961edbd47040dbe29241d252478847ebbf8554db3e197e909c36e17cd56f5

    • Size

      4.3MB

    • MD5

      1a3a539d46d864a5c10bbe55150e03f3

    • SHA1

      8d2d3d4dfe96b4c8fc62264a22bdd289749f0756

    • SHA256

      7fc961edbd47040dbe29241d252478847ebbf8554db3e197e909c36e17cd56f5

    • SHA512

      3504e27c5a6b2e0bc8fa8cf39ef1225df6ef9be6be0bb874d0ebed5dbf4296cd9b9056e018ee5a76067495fcf410b43a16b1d84f1f4e7aa65dac501f9c5c2908

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks