General

  • Target

    0067cecd94af16e616ede4fc3b60990b1f31a52808f8e3b425400229f8194619

  • Size

    1.6MB

  • Sample

    221127-n48ltsac9z

  • MD5

    78fb0b7f1ba9d3c61267ad1c180d125f

  • SHA1

    f4c73862fbc4a354e96ad2a3be549ee6999fd306

  • SHA256

    0067cecd94af16e616ede4fc3b60990b1f31a52808f8e3b425400229f8194619

  • SHA512

    3589e84a43708d4bdd9c768a60e3e6c158f41eda8ca44f91f4732e83f952f8f800c4cbb7b5b7c4bb8fd68313e15e7b0a69336576bba05816fa566017d5c7a095

  • SSDEEP

    24576:4B0VxGMGMfYinDZ1NsLp4GVh1nxYhU+itwOrVjacamTo1vce6NiplQ1Sm42O:4B/aYqnNs14GJnxYzYjx05IITQfBO

Malware Config

Targets

    • Target

      0067cecd94af16e616ede4fc3b60990b1f31a52808f8e3b425400229f8194619

    • Size

      1.6MB

    • MD5

      78fb0b7f1ba9d3c61267ad1c180d125f

    • SHA1

      f4c73862fbc4a354e96ad2a3be549ee6999fd306

    • SHA256

      0067cecd94af16e616ede4fc3b60990b1f31a52808f8e3b425400229f8194619

    • SHA512

      3589e84a43708d4bdd9c768a60e3e6c158f41eda8ca44f91f4732e83f952f8f800c4cbb7b5b7c4bb8fd68313e15e7b0a69336576bba05816fa566017d5c7a095

    • SSDEEP

      24576:4B0VxGMGMfYinDZ1NsLp4GVh1nxYhU+itwOrVjacamTo1vce6NiplQ1Sm42O:4B/aYqnNs14GJnxYzYjx05IITQfBO

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Defense Evasion

Hidden Files and Directories

2
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks