Overview

overview

10

Static

static

9aee7ce88b...6f.exe

windows7_x64

10

9aee7ce88b...6f.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aee7ce88be5a073948288a5a5b0a1dc1cf6a9ea73dce2c6cdd5e47942edcd6f

  • Size

    4.8MB

  • Sample

    220524-vfpx5seaan

  • MD5

    0d0e37472e7bdea8cd7d9564fd2e41bc

  • SHA1

    68b40398a9759f91a790b89474009840d3651b04

  • SHA256

    9aee7ce88be5a073948288a5a5b0a1dc1cf6a9ea73dce2c6cdd5e47942edcd6f

  • SHA512

    0bd337f72f1b309e0f477f15d248e793be80cb14fa39f142362bb2a18043d41179d362e8801dcb997b65282ef892d07a606f5dfe3f701999379da5a1b527e545

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      9aee7ce88be5a073948288a5a5b0a1dc1cf6a9ea73dce2c6cdd5e47942edcd6f

    • Size

      4.8MB

    • MD5

      0d0e37472e7bdea8cd7d9564fd2e41bc

    • SHA1

      68b40398a9759f91a790b89474009840d3651b04

    • SHA256

      9aee7ce88be5a073948288a5a5b0a1dc1cf6a9ea73dce2c6cdd5e47942edcd6f

    • SHA512

      0bd337f72f1b309e0f477f15d248e793be80cb14fa39f142362bb2a18043d41179d362e8801dcb997b65282ef892d07a606f5dfe3f701999379da5a1b527e545

    Score
    10/10
    rmsrattrojanevasionupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks