Overview

overview

10

Static

static

8

7405b46d5f...e1.exe

windows7-x64

10

7405b46d5f...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7405b46d5f93ea04e7ecd588ee4bd1de76579689e07986895bbbaeec4f2bf9e1

  • Size

    4.1MB

  • Sample

    221127-bw1j2aae42

  • MD5

    5667aae6c34c2aed84dc344f2f7594ce

  • SHA1

    858632f13d298ecb49c8b50bc3fd1e56c6b3ad33

  • SHA256

    7405b46d5f93ea04e7ecd588ee4bd1de76579689e07986895bbbaeec4f2bf9e1

  • SHA512

    bff05864a430f2abdc78991a322d0ea686c24d6fc60ec8ef71aa422e484ee40b19991ef4f3ce70a7d64567fb804de2b8e16c8d6a3d4246ebc4f51f00ccf9f78a

  • SSDEEP

    98304:1joLchbHlbSEmlKVr8+loohgLijiAJdTvJbl:1Schk7u4+lJRhvJB

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      7405b46d5f93ea04e7ecd588ee4bd1de76579689e07986895bbbaeec4f2bf9e1

    • Size

      4.1MB

    • MD5

      5667aae6c34c2aed84dc344f2f7594ce

    • SHA1

      858632f13d298ecb49c8b50bc3fd1e56c6b3ad33

    • SHA256

      7405b46d5f93ea04e7ecd588ee4bd1de76579689e07986895bbbaeec4f2bf9e1

    • SHA512

      bff05864a430f2abdc78991a322d0ea686c24d6fc60ec8ef71aa422e484ee40b19991ef4f3ce70a7d64567fb804de2b8e16c8d6a3d4246ebc4f51f00ccf9f78a

    • SSDEEP

      98304:1joLchbHlbSEmlKVr8+loohgLijiAJdTvJbl:1Schk7u4+lJRhvJB

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks