Overview

overview

10

Static

static

30bcdce35f...2f.exe

windows7_x64

10

30bcdce35f...2f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30bcdce35f1714b369b0b5ea3a12070175efe352623f221072d18a9935336f2f

  • Size

    4.8MB

  • Sample

    220524-1nlhksdafq

  • MD5

    6a5f11c83d8e52916775b793437452dc

  • SHA1

    045b04cc90122abf816e48b5b17f6e2718bf1cc0

  • SHA256

    30bcdce35f1714b369b0b5ea3a12070175efe352623f221072d18a9935336f2f

  • SHA512

    3dd92f642bbbf5e89a64611bcbd04fd88cdb22ffac00d0b40c44111c29c36250b6ec39ef9ad792bf73172a2c8c069988e35e737a90bd44ea9184ed5c876a3bfc

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      30bcdce35f1714b369b0b5ea3a12070175efe352623f221072d18a9935336f2f

    • Size

      4.8MB

    • MD5

      6a5f11c83d8e52916775b793437452dc

    • SHA1

      045b04cc90122abf816e48b5b17f6e2718bf1cc0

    • SHA256

      30bcdce35f1714b369b0b5ea3a12070175efe352623f221072d18a9935336f2f

    • SHA512

      3dd92f642bbbf5e89a64611bcbd04fd88cdb22ffac00d0b40c44111c29c36250b6ec39ef9ad792bf73172a2c8c069988e35e737a90bd44ea9184ed5c876a3bfc

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks