Overview

overview

10

Static

static

f222a50332...ac.exe

windows7_x64

10

f222a50332...ac.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f222a5033229abdd7e841b837a35950b69ffd63a5b7d61bba88e524baaf71eac

  • Size

    6.3MB

  • Sample

    220701-e1ae7adfg7

  • MD5

    22e54983913badd5201e7bcb63691a84

  • SHA1

    5fb006efd2ea4cff9f6aca0cd4ce354b9aea405d

  • SHA256

    f222a5033229abdd7e841b837a35950b69ffd63a5b7d61bba88e524baaf71eac

  • SHA512

    128064d312842bd394ff490291e25cc640dbcab6ab7bd69f87c79cd6e8bbb997c588e2dd722b2af3e7c8da62dcd7039e00c62fd47fd5e79b71fdd742edad84ed

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      f222a5033229abdd7e841b837a35950b69ffd63a5b7d61bba88e524baaf71eac

    • Size

      6.3MB

    • MD5

      22e54983913badd5201e7bcb63691a84

    • SHA1

      5fb006efd2ea4cff9f6aca0cd4ce354b9aea405d

    • SHA256

      f222a5033229abdd7e841b837a35950b69ffd63a5b7d61bba88e524baaf71eac

    • SHA512

      128064d312842bd394ff490291e25cc640dbcab6ab7bd69f87c79cd6e8bbb997c588e2dd722b2af3e7c8da62dcd7039e00c62fd47fd5e79b71fdd742edad84ed

    Score
    10/10
    rmspersistencerattrojan

    • Modifies WinLogon for persistence

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks