Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1d8291a5cb...18.exe

windows7_x64

10

1d8291a5cb...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d8291a5cba2f38b160dfc10921e29a54799ff0ef634b410aa1a6618b04fb518

  • Size

    6.2MB

  • Sample

    220525-ax8fladcf7

  • MD5

    0a6c36584f98ec2f98121071477e7702

  • SHA1

    6c839ed190e408f65b3b0c856e5adcb1d305c067

  • SHA256

    1d8291a5cba2f38b160dfc10921e29a54799ff0ef634b410aa1a6618b04fb518

  • SHA512

    1e620fe29a47929c491fbe3003ae0177e4f7ff5b90c5b456f54fd67d17916c8657f80552f7f0acfd333fc0f393555d9202a564edc4f4ed5a2c9282691b414442

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      1d8291a5cba2f38b160dfc10921e29a54799ff0ef634b410aa1a6618b04fb518

    • Size

      6.2MB

    • MD5

      0a6c36584f98ec2f98121071477e7702

    • SHA1

      6c839ed190e408f65b3b0c856e5adcb1d305c067

    • SHA256

      1d8291a5cba2f38b160dfc10921e29a54799ff0ef634b410aa1a6618b04fb518

    • SHA512

      1e620fe29a47929c491fbe3003ae0177e4f7ff5b90c5b456f54fd67d17916c8657f80552f7f0acfd333fc0f393555d9202a564edc4f4ed5a2c9282691b414442

    Score
    10/10
    rmspersistencerattrojan

    • Modifies WinLogon for persistence

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks