Overview

overview

10

Static

static

8

Agent.exe

windows7_x64

10

Agent.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agent.exe

  • Size

    15.1MB

  • Sample

    220601-v1zcbaechr

  • MD5

    9de172eac24fe6112da5f45bf049b114

  • SHA1

    f549aa49c96bbe41ad4267c4cde86f2d43702740

  • SHA256

    53da1a16c1cd90fa7dd43e4e6d4bfb8b36ce8eb1d8918dda7aef01e9befbd1ff

  • SHA512

    efed137ce92b7907f8a25c7dc8318ed1f263ded742d4fa02e4337d6e7eea11657c5bb7e6f70bd68226a17aaf2e2e510b05ff3252f26523646f171ecba0042050

Score
10/10
rmsrattrojanupx

Malware Config

Targets

    • Target

      Agent.exe

    • Size

      15.1MB

    • MD5

      9de172eac24fe6112da5f45bf049b114

    • SHA1

      f549aa49c96bbe41ad4267c4cde86f2d43702740

    • SHA256

      53da1a16c1cd90fa7dd43e4e6d4bfb8b36ce8eb1d8918dda7aef01e9befbd1ff

    • SHA512

      efed137ce92b7907f8a25c7dc8318ed1f263ded742d4fa02e4337d6e7eea11657c5bb7e6f70bd68226a17aaf2e2e510b05ff3252f26523646f171ecba0042050

    Score
    10/10
    rmsrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks