Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

09f1f3a51f...37.exe

windows7_x64

1

09f1f3a51f...37.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09f1f3a51f27caf87008f9543eb415178b4fa85715eaa9ddbb100ffc2f2d0437

  • Size

    4.0MB

  • Sample

    220524-t6ez7ahgd4

  • MD5

    8ec454c70b35e6f39e98c5375f730476

  • SHA1

    a3b6297f489c5701294166503e2f691ded393df0

  • SHA256

    09f1f3a51f27caf87008f9543eb415178b4fa85715eaa9ddbb100ffc2f2d0437

  • SHA512

    c95fb98bfe57e87809f960da9dbb7696f17676595e60fe0a0d555a56fe0f2cb8c35ce0beb71b830df35776da3d38f0c34246678aa03b22d56beca015df914faa

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      09f1f3a51f27caf87008f9543eb415178b4fa85715eaa9ddbb100ffc2f2d0437

    • Size

      4.0MB

    • MD5

      8ec454c70b35e6f39e98c5375f730476

    • SHA1

      a3b6297f489c5701294166503e2f691ded393df0

    • SHA256

      09f1f3a51f27caf87008f9543eb415178b4fa85715eaa9ddbb100ffc2f2d0437

    • SHA512

      c95fb98bfe57e87809f960da9dbb7696f17676595e60fe0a0d555a56fe0f2cb8c35ce0beb71b830df35776da3d38f0c34246678aa03b22d56beca015df914faa

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks