General

  • Target

    d8c705cb45f2a1e7683e0be01109c3951caf72e5c9aefff41a6944df5eeabf0f

  • Size

    4.7MB

  • Sample

    220524-rcsm3shbeq

  • MD5

    d2b56fde590039b98fa7b014313a36b2

  • SHA1

    4e7db2e82086949812974a47175324dea675581b

  • SHA256

    d8c705cb45f2a1e7683e0be01109c3951caf72e5c9aefff41a6944df5eeabf0f

  • SHA512

    0fd75b332aff8d77705878e9dec0f6dc44cdd8ccce8400398d8fba843a63179d4e08d6007699b7aec9c163a943375feb324ceca0db231386cae4a142a73be218

Malware Config

Targets

    • Target

      d8c705cb45f2a1e7683e0be01109c3951caf72e5c9aefff41a6944df5eeabf0f

    • Size

      4.7MB

    • MD5

      d2b56fde590039b98fa7b014313a36b2

    • SHA1

      4e7db2e82086949812974a47175324dea675581b

    • SHA256

      d8c705cb45f2a1e7683e0be01109c3951caf72e5c9aefff41a6944df5eeabf0f

    • SHA512

      0fd75b332aff8d77705878e9dec0f6dc44cdd8ccce8400398d8fba843a63179d4e08d6007699b7aec9c163a943375feb324ceca0db231386cae4a142a73be218

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks