rms | cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb

Analysis

max time kernel
172s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe
Size 4.2MB
Sample221121-3bycqabc64
SHA256 cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb
MD5 f4b07754f4b0c67ab073b28476b809af
SHA1 5a4385db9a7a2878e7116f4e71ae2eeb7717bf9e
SHA512 ebc961fcfa90e4f96191759627f308ccf1a8471a70350f3526be7b4e223b46fca6bcd90e26e59cb7327124050f6fe43aac03b93c35cb7f3f8b9d806c05d662ef
SSDEEP 98304:RVZb+Ma7ksZGweOjnvbE7WSW1xTAvpB+sK5/FoUS9T:Nb+CurBjjE7WSWe+sKvpS9T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000002319a-147.dat	acprotect
behavioral2/files/0x0007000000023199-146.dat	acprotect

Executes dropped EXE 7 IoCs

pid	Process
4700	rutserv.exe
1288	rutserv.exe
3904	rutserv.exe
4488	rutserv.exe
3192	rfusclient.exe
1816	rfusclient.exe
3732	rfusclient.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3228	attrib.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002319a-147.dat	upx
behavioral2/files/0x0007000000023199-146.dat	upx
behavioral2/files/0x000600000002319b-171.dat	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\control.ini	cmd.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\russian.lg	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
224	timeout.exe
4324	timeout.exe
3764	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4128	tasklist.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
308	taskkill.exe
4628	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3064	regedit.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4700	rutserv.exe
4700	rutserv.exe
4700	rutserv.exe
4700	rutserv.exe
4700	rutserv.exe
4700	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
3904	rutserv.exe
3904	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
1816	rfusclient.exe
1816	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3732	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	4700	rutserv.exe
Token: SeDebugPrivilege	3904	rutserv.exe
Token: SeTakeOwnershipPrivilege	4488	rutserv.exe
Token: SeTcbPrivilege	4488	rutserv.exe
Token: SeTcbPrivilege	4488	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 3124	4668	cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe	83
PID 4668 wrote to memory of 3124	4668	cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe	83
PID 4668 wrote to memory of 3124	4668	cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe	83
PID 3124 wrote to memory of 2832	3124	WScript.exe	84
PID 3124 wrote to memory of 2832	3124	WScript.exe	84
PID 3124 wrote to memory of 2832	3124	WScript.exe	84
PID 2832 wrote to memory of 408	2832	cmd.exe	86
PID 2832 wrote to memory of 408	2832	cmd.exe	86
PID 2832 wrote to memory of 408	2832	cmd.exe	86
PID 2832 wrote to memory of 4628	2832	cmd.exe	87
PID 2832 wrote to memory of 4628	2832	cmd.exe	87
PID 2832 wrote to memory of 4628	2832	cmd.exe	87
PID 2832 wrote to memory of 308	2832	cmd.exe	88
PID 2832 wrote to memory of 308	2832	cmd.exe	88
PID 2832 wrote to memory of 308	2832	cmd.exe	88
PID 2832 wrote to memory of 224	2832	cmd.exe	89
PID 2832 wrote to memory of 224	2832	cmd.exe	89
PID 2832 wrote to memory of 224	2832	cmd.exe	89
PID 2832 wrote to memory of 4128	2832	cmd.exe	90
PID 2832 wrote to memory of 4128	2832	cmd.exe	90
PID 2832 wrote to memory of 4128	2832	cmd.exe	90
PID 2832 wrote to memory of 1316	2832	cmd.exe	91
PID 2832 wrote to memory of 1316	2832	cmd.exe	91
PID 2832 wrote to memory of 1316	2832	cmd.exe	91
PID 2832 wrote to memory of 4324	2832	cmd.exe	92
PID 2832 wrote to memory of 4324	2832	cmd.exe	92
PID 2832 wrote to memory of 4324	2832	cmd.exe	92
PID 2832 wrote to memory of 3064	2832	cmd.exe	93
PID 2832 wrote to memory of 3064	2832	cmd.exe	93
PID 2832 wrote to memory of 3064	2832	cmd.exe	93
PID 2832 wrote to memory of 3128	2832	cmd.exe	94
PID 2832 wrote to memory of 3128	2832	cmd.exe	94
PID 2832 wrote to memory of 3128	2832	cmd.exe	94
PID 2832 wrote to memory of 3228	2832	cmd.exe	95
PID 2832 wrote to memory of 3228	2832	cmd.exe	95
PID 2832 wrote to memory of 3228	2832	cmd.exe	95
PID 2832 wrote to memory of 2308	2832	cmd.exe	96
PID 2832 wrote to memory of 2308	2832	cmd.exe	96
PID 2832 wrote to memory of 2308	2832	cmd.exe	96
PID 2832 wrote to memory of 2348	2832	cmd.exe	97
PID 2832 wrote to memory of 2348	2832	cmd.exe	97
PID 2832 wrote to memory of 2348	2832	cmd.exe	97
PID 2832 wrote to memory of 4700	2832	cmd.exe	98
PID 2832 wrote to memory of 4700	2832	cmd.exe	98
PID 2832 wrote to memory of 4700	2832	cmd.exe	98
PID 2832 wrote to memory of 1288	2832	cmd.exe	99
PID 2832 wrote to memory of 1288	2832	cmd.exe	99
PID 2832 wrote to memory of 1288	2832	cmd.exe	99
PID 2832 wrote to memory of 4032	2832	cmd.exe	100
PID 2832 wrote to memory of 4032	2832	cmd.exe	100
PID 2832 wrote to memory of 4032	2832	cmd.exe	100
PID 2832 wrote to memory of 3988	2832	cmd.exe	101
PID 2832 wrote to memory of 3988	2832	cmd.exe	101
PID 2832 wrote to memory of 3988	2832	cmd.exe	101
PID 2832 wrote to memory of 3904	2832	cmd.exe	102
PID 2832 wrote to memory of 3904	2832	cmd.exe	102
PID 2832 wrote to memory of 3904	2832	cmd.exe	102
PID 4488 wrote to memory of 1816	4488	rutserv.exe	105
PID 4488 wrote to memory of 1816	4488	rutserv.exe	105
PID 4488 wrote to memory of 1816	4488	rutserv.exe	105
PID 4488 wrote to memory of 3192	4488	rutserv.exe	104
PID 4488 wrote to memory of 3192	4488	rutserv.exe	104
PID 4488 wrote to memory of 3192	4488	rutserv.exe	104
PID 2832 wrote to memory of 3764	2832	cmd.exe	106

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3228	attrib.exe
2308	attrib.exe
2348	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe
"C:\Users\Admin\AppData\Local\Temp\cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exes\io.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exes\setup.bat" "
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      PID:408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rfusclient.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rutserv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:224
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq wget.exe" /NH
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4128
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "wget.exe"
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4324
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s "regedit.reg"
      4⤵
      Runs .reg file with regedit
      PID:3064
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /v FUSClientPath /t REG_SZ /d "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe" /f
      4⤵
      PID:3128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\*.*"
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2348
  - - C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
      "rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
  - - C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
      "rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v DisplayName /t REG_SZ /d "Microsoft Corporation" /f
      4⤵
      PID:4032
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v Description /t REG_SZ /d "Microsoft Windows" /f
      4⤵
      PID:3988
  - - C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
      rutserv.exe /start
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3904
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3764

C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- - C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
    C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bat.bat

Path C:\Users\Admin\AppData\Local\Temp\exes\bat.bat
Size 178B
SHA256 3f35efb7d0ed5d56700451431d4d3626ef1cebf7289dbf75cda7123f53e91746
MD5 b8dda233f9810dc7da01ab6bb0a7d34d
SHA1 749d2f14ab86fdcd23ddbaad99c9b974c4ae6dd4
SHA512 6b47cee19f74a4f90d326cb88a27ab5bcf2f8e90c46490bcd23cd24f7aeb50649f8344a21d1da93c24b6af334fdf3a5fc45143ce137469edac84bead8bf5a95c
MD5 SHA1 SHA512

Submit Download

bat.vbs

Path C:\Users\Admin\AppData\Local\Temp\exes\bat.vbs
Size 113B
SHA256 9413f4a4084d653e2acd3ea80282a261d8356f2605ae7a502ef364c54d4ab2d8
MD5 9a9ec59df719a15b2cadb19ecce9adfd
SHA1 172b551d1d04c93c8bb52ead5a88b084e3c8f469
SHA512 1f1f678802ad5d5b86824ae789d8ebc64abc8d84686118051f73cfb0f3c6ff41ef19478f4073040d864fc697fe047bf7cd715632eb9b1b1f4d6e4e5799907b20
MD5 SHA1 SHA512

Submit Download

de.exe

Path C:\Users\Admin\AppData\Local\Temp\exes\de.exe
Size 98KB
SHA256 507af2772c7740f66fd15211f260f7f1989e433b31367587812fce3f67679c51
MD5 3234ca7ffaab06077240020bb183659f
SHA1 9614bb744a82156f461e4b685c0fe570b4776599
SHA512 0878b6ef55b11ba632a544e01af4836b00d0b0e4eca7033549d9ac2ad2132a7cab275a4027f8f994fc5e0b99918a657faf2d7914c85d8530742f62d7b3ee06c9
SSDEEP 3072:JWcZvNlEpqqJ7QkHJt2NvSx2felU2NJrIzHM:JWAOpTJ7QkpkfelNJrIzs
MD5 SHA1 SHA512 SSDEEP

Submit Download

io.vbs

Path C:\Users\Admin\AppData\Local\Temp\exes\io.vbs
Size 115B
SHA256 fad0bbb55f7591b441b351fb693b128f2e384685bf576201d942c10e0047df4f
MD5 1314d834dc9a58668956252e40c8af4d
SHA1 5d5062e6b06aad2c1f1e51e18e0e293dba1e1a66
SHA512 73e636d95414bec0c987ffbe431d16e95c8d95c72d9504880b4e9cdd1a1064bc6afc43974e281bd2c852fa0cc883d131ca5cb27ee3d4966b4c5b09343c52dcc9
MD5 SHA1 SHA512

Submit Download

regedit.reg

Path C:\Users\Admin\AppData\Local\Temp\exes\regedit.reg
Size 24KB
SHA256 bddce3bcce882e9695872650a9887a5fb877fc967044426d11fc048a5896d1ad
MD5 99d13bb2c0e01de7411739a3401b0a23
SHA1 9d07fcbcd60554cec1427e7cfbbf466ebdaaaa1f
SHA512 d75b278597e04da6b4f96a058eb8aba033d9ed70ad7b8334317cf3d5d081b45b5656a5faa6a09b5836277cd0d4ba45d39fc190d4ed04e72377c2ea7d8eaf1b85
SSDEEP 768:5HcpAKL80J1HhUPqHrRD0IftZIiy5uJy0:s7
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Local\Temp\exes\rfusclient.exe
Size 4.8MB
SHA256 1e35b3107c8d02bd7184cae941b75dfb7d5fb674da6f30c7ed2cad58c0de2987
MD5 1040073244f599b73b3f383412aa9640
SHA1 3cd9b3baa4de24767a2918d03f455d58fa32ff44
SHA512 87fc4d91d229390ff968e1ce1d4c508ffe4c564d8103dcb3685f5df79e392144b2c73df3ef162329ed197a3b0959224e8346716bc347743669172da8211faf7c
SSDEEP 49152:M2lgbuQ9HT5uhk2tjsS0CBhgnHBnscczifKo/uW0zDg51PKa5TUTXq3XUT/xEK9m:M2lgiCzHsQKo/uW0z+KqETG5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

russian.lg

Path C:\Users\Admin\AppData\Local\Temp\exes\russian.lg
Size 48KB
SHA256 ef247557be6f34aa3ec855e0d0a0367ae0660ff3104791e345363904428de7e8
MD5 9558b5bc81eb3d87ca356676cd22a09a
SHA1 1851e3eed3aff625cf9336694d6374ce24ad5814
SHA512 4f034167680f90cb166ad73a52fca40e863f63fe056917bb0603132bbeccc592ddb4a9c7f7a10dd022ec5b326bd24f68b9ebbcbc02879b6419fcdfb6903be434
SSDEEP 384:PKS6FpsTkMiUUaOVnYwu6DI4KfcBzGlcNN7sdW:OsTkTHnKfcBRP
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Local\Temp\exes\rutserv.exe
Size 5.8MB
SHA256 3525603566f45c7afcd6119d5181fbf1b6306ca8c44d12e29f72fdf3bca612f7
MD5 08b50eec7aa610a427fb98673cac6f57
SHA1 dc35911c23632f24ce18c1b1d4a95b6e8dfbbe20
SHA512 4b5208f0cb00b5d0871e8060234634073edd28b902168855044f3283afeff570b2b947c3b682d57a31dae2c92b11dd694398cba23c1354555957011580d4f2ef
SSDEEP 49152:Gpfs0fEmQlEnRANqSOkdtOCBSlHpLriILXlJusWX+P/qc1iTGXThTySgAcMD+7Zq:GFs4ZLzWX+P/11iT0/cNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.bat

Path C:\Users\Admin\AppData\Local\Temp\exes\setup.bat
Size 14KB
SHA256 e7053729708353f327cefdefc92b2fb3dae9c595b56427f9f80f2ad4c432aad3
MD5 db67fd8b8c3204ac5ac8dfd4fdf7bb4b
SHA1 98e2b85bc9c16cf3f1f522d724b12f8b0d8aa03b
SHA512 e3386bd35570bc0e667b0209836c517d028f03208407c414d6a3e47a415ac71b48dd7b22c926d0f775dde46c9106f55bc1a13aa540effca3c667710ff0af5d75
SSDEEP 384:u9t9j9k9t959d999h6RyxqPxw1lGOiB9O9l9l9m9+9a9l9X9D9s9o9U9V9z9g94k:uXp+XvXPz6RyxqPxw1lGOiBILDUI4H9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Local\Temp\exes\vp8decoder.dll
Size 151KB
SHA256 7be9bbf87492a63833f6f2665e461d4e097e3326dec3e7984ecca8a916939843
MD5 565f817a855a681f0b386c9fe970f764
SHA1 da0645c4dd38bfc6415c4e083b505715b8b2bc75
SHA512 0e851284a2c2ea1db7adeaf108cee42472018ff85e8ff28954643f417ff8b61d6d30944112678d47f65b952dbc69c097d3faf54e60b84a51eb92f07efde84f8d
SSDEEP 3072:2WRejw63Ktetg4bVV5vctu089Z6ccRXhPXGAYAuvGSpImqmRzw4M:2njw6xg4bz5hRZ2Xh/GZAuvGvmqmS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Local\Temp\exes\vp8encoder.dll
Size 257KB
SHA256 a1507cb1240e89bf4f3468f462a5befab762edac1540b0d5f4839c46b137859b
MD5 fd0c05de8c367b6f843c96f014f0d9d7
SHA1 68e6b3d8c3b906b74618c6f17c52b5ad19ab857b
SHA512 12ace11d440f5fad425781f29bd94a12025718764670f0b56d49f8337cd09f43fa0a5d9579d65dcacd47f0dea3a3053b52af795c83972ae1bcc24e5a1cdce13f
SSDEEP 6144:nUcoeeKB8Ep59pYH/AOBo/d0z5ME2G+/ZET9+wdW4xdx8:UcQKB8A57Q4PF0KEq/ZET9+Nix8
MD5 SHA1 SHA512 SSDEEP

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Local\Temp\exes\wget.exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
Size 4.8MB
SHA256 1e35b3107c8d02bd7184cae941b75dfb7d5fb674da6f30c7ed2cad58c0de2987
MD5 1040073244f599b73b3f383412aa9640
SHA1 3cd9b3baa4de24767a2918d03f455d58fa32ff44
SHA512 87fc4d91d229390ff968e1ce1d4c508ffe4c564d8103dcb3685f5df79e392144b2c73df3ef162329ed197a3b0959224e8346716bc347743669172da8211faf7c
SSDEEP 49152:M2lgbuQ9HT5uhk2tjsS0CBhgnHBnscczifKo/uW0zDg51PKa5TUTXq3XUT/xEK9m:M2lgiCzHsQKo/uW0z+KqETG5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
Size 4.8MB
SHA256 1e35b3107c8d02bd7184cae941b75dfb7d5fb674da6f30c7ed2cad58c0de2987
MD5 1040073244f599b73b3f383412aa9640
SHA1 3cd9b3baa4de24767a2918d03f455d58fa32ff44
SHA512 87fc4d91d229390ff968e1ce1d4c508ffe4c564d8103dcb3685f5df79e392144b2c73df3ef162329ed197a3b0959224e8346716bc347743669172da8211faf7c
SSDEEP 49152:M2lgbuQ9HT5uhk2tjsS0CBhgnHBnscczifKo/uW0zDg51PKa5TUTXq3XUT/xEK9m:M2lgiCzHsQKo/uW0z+KqETG5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
Size 4.8MB
SHA256 1e35b3107c8d02bd7184cae941b75dfb7d5fb674da6f30c7ed2cad58c0de2987
MD5 1040073244f599b73b3f383412aa9640
SHA1 3cd9b3baa4de24767a2918d03f455d58fa32ff44
SHA512 87fc4d91d229390ff968e1ce1d4c508ffe4c564d8103dcb3685f5df79e392144b2c73df3ef162329ed197a3b0959224e8346716bc347743669172da8211faf7c
SSDEEP 49152:M2lgbuQ9HT5uhk2tjsS0CBhgnHBnscczifKo/uW0zDg51PKa5TUTXq3XUT/xEK9m:M2lgiCzHsQKo/uW0z+KqETG5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
Size 5.8MB
SHA256 3525603566f45c7afcd6119d5181fbf1b6306ca8c44d12e29f72fdf3bca612f7
MD5 08b50eec7aa610a427fb98673cac6f57
SHA1 dc35911c23632f24ce18c1b1d4a95b6e8dfbbe20
SHA512 4b5208f0cb00b5d0871e8060234634073edd28b902168855044f3283afeff570b2b947c3b682d57a31dae2c92b11dd694398cba23c1354555957011580d4f2ef
SSDEEP 49152:Gpfs0fEmQlEnRANqSOkdtOCBSlHpLriILXlJusWX+P/qc1iTGXThTySgAcMD+7Zq:GFs4ZLzWX+P/11iT0/cNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
Size 5.8MB
SHA256 3525603566f45c7afcd6119d5181fbf1b6306ca8c44d12e29f72fdf3bca612f7
MD5 08b50eec7aa610a427fb98673cac6f57
SHA1 dc35911c23632f24ce18c1b1d4a95b6e8dfbbe20
SHA512 4b5208f0cb00b5d0871e8060234634073edd28b902168855044f3283afeff570b2b947c3b682d57a31dae2c92b11dd694398cba23c1354555957011580d4f2ef
SSDEEP 49152:Gpfs0fEmQlEnRANqSOkdtOCBSlHpLriILXlJusWX+P/qc1iTGXThTySgAcMD+7Zq:GFs4ZLzWX+P/11iT0/cNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
Size 5.8MB
SHA256 3525603566f45c7afcd6119d5181fbf1b6306ca8c44d12e29f72fdf3bca612f7
MD5 08b50eec7aa610a427fb98673cac6f57
SHA1 dc35911c23632f24ce18c1b1d4a95b6e8dfbbe20
SHA512 4b5208f0cb00b5d0871e8060234634073edd28b902168855044f3283afeff570b2b947c3b682d57a31dae2c92b11dd694398cba23c1354555957011580d4f2ef
SSDEEP 49152:Gpfs0fEmQlEnRANqSOkdtOCBSlHpLriILXlJusWX+P/qc1iTGXThTySgAcMD+7Zq:GFs4ZLzWX+P/11iT0/cNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
Size 5.8MB
SHA256 3525603566f45c7afcd6119d5181fbf1b6306ca8c44d12e29f72fdf3bca612f7
MD5 08b50eec7aa610a427fb98673cac6f57
SHA1 dc35911c23632f24ce18c1b1d4a95b6e8dfbbe20
SHA512 4b5208f0cb00b5d0871e8060234634073edd28b902168855044f3283afeff570b2b947c3b682d57a31dae2c92b11dd694398cba23c1354555957011580d4f2ef
SSDEEP 49152:Gpfs0fEmQlEnRANqSOkdtOCBSlHpLriILXlJusWX+P/qc1iTGXThTySgAcMD+7Zq:GFs4ZLzWX+P/11iT0/cNi
MD5 SHA1 SHA512 SSDEEP

Submit Download