Overview

overview

10

Static

static

3a6b2b890d...e8.exe

windows7-x64

10

3a6b2b890d...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a6b2b890d0f5071191021f4850632a827a5e17f9d72855a65e253d8125e1de8

  • Size

    6.2MB

  • Sample

    221126-p5a8dsdh38

  • MD5

    d72290cd8656ce7ac855e46a5c716019

  • SHA1

    5d25cc2f93479c438b7d1e2470f2d7320f661ccb

  • SHA256

    3a6b2b890d0f5071191021f4850632a827a5e17f9d72855a65e253d8125e1de8

  • SHA512

    edb4777a1499d58219c02ff7f34bf7d30ce5924390ed0fcc773e3552c2091fa38d7439488e294b3246e4985f5c10675bf9231596f73396c855758562aa6d972f

  • SSDEEP

    98304:tWHzMCPRU7pQiHFGZ3aHmkbfkZpsPrcqqrfYL0RZWQnPQRm+SlDGj9uVO6UT+PfL:tozM4a7pzAaHdzkIPw9Y0S6PQRya5AJ

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      3a6b2b890d0f5071191021f4850632a827a5e17f9d72855a65e253d8125e1de8

    • Size

      6.2MB

    • MD5

      d72290cd8656ce7ac855e46a5c716019

    • SHA1

      5d25cc2f93479c438b7d1e2470f2d7320f661ccb

    • SHA256

      3a6b2b890d0f5071191021f4850632a827a5e17f9d72855a65e253d8125e1de8

    • SHA512

      edb4777a1499d58219c02ff7f34bf7d30ce5924390ed0fcc773e3552c2091fa38d7439488e294b3246e4985f5c10675bf9231596f73396c855758562aa6d972f

    • SSDEEP

      98304:tWHzMCPRU7pQiHFGZ3aHmkbfkZpsPrcqqrfYL0RZWQnPQRm+SlDGj9uVO6UT+PfL:tozM4a7pzAaHdzkIPw9Y0S6PQRya5AJ

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks