Overview

overview

10

Static

static

8595d98ac5...79.exe

windows7-x64

10

8595d98ac5...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8595d98ac51b43f0bb857e742204f0e2729497cfa48df985e018d4b9d16bc379.exe

  • Size

    5.2MB

  • Sample

    221008-n31vlaeff9

  • MD5

    f44d3d3f38277b9fcebbf502d42932de

  • SHA1

    cbe41a2f4a3c0e1ca562e305f2a9130fb44f48ee

  • SHA256

    8595d98ac51b43f0bb857e742204f0e2729497cfa48df985e018d4b9d16bc379

  • SHA512

    954ece50a66274c76a1b5689f1413723f08dff65444e73424e9c2ce8a37726cd1830ab6a1a2dee2fe6aae3f0060de43af6bfbe7a3562254742dc491e5e007c19

  • SSDEEP

    98304:4d3DAwjFAtBFuquha3B6YcnJU4zRYn05tYENoe/dRgh3mV0lnu0vNDge0N3VS:4dTAwhEfXIXJrRYnada40FO1U

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      8595d98ac51b43f0bb857e742204f0e2729497cfa48df985e018d4b9d16bc379.exe

    • Size

      5.2MB

    • MD5

      f44d3d3f38277b9fcebbf502d42932de

    • SHA1

      cbe41a2f4a3c0e1ca562e305f2a9130fb44f48ee

    • SHA256

      8595d98ac51b43f0bb857e742204f0e2729497cfa48df985e018d4b9d16bc379

    • SHA512

      954ece50a66274c76a1b5689f1413723f08dff65444e73424e9c2ce8a37726cd1830ab6a1a2dee2fe6aae3f0060de43af6bfbe7a3562254742dc491e5e007c19

    • SSDEEP

      98304:4d3DAwjFAtBFuquha3B6YcnJU4zRYn05tYENoe/dRgh3mV0lnu0vNDge0N3VS:4dTAwhEfXIXJrRYnada40FO1U

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks