Overview

overview

10

Static

static

505cd63c93...3f.exe

windows7-x64

10

505cd63c93...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f

  • Size

    1.3MB

  • Sample

    221128-d8av9agb8v

  • MD5

    9b0203bba061b219a93707efbd1e7c7a

  • SHA1

    252c00ee2749e0d1db79553cf49334c240908cad

  • SHA256

    505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f

  • SHA512

    6ee37a8e637343581fe1c004a3fbdc23b5a5b3e6b1ed1f10b3b42fac1144f147384fcb94c80bae72dd8efc2db14742828bcf1f018bdddd1d41fc4c037b2a2225

  • SSDEEP

    24576:PaUxvxK4nXQEuJhZMPfpwAuTJOmzORONakqXRlaL8TsJyyMptS:5JKyXvuDUfUHTNZwaL8IJyhps

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f

    • Size

      1.3MB

    • MD5

      9b0203bba061b219a93707efbd1e7c7a

    • SHA1

      252c00ee2749e0d1db79553cf49334c240908cad

    • SHA256

      505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f

    • SHA512

      6ee37a8e637343581fe1c004a3fbdc23b5a5b3e6b1ed1f10b3b42fac1144f147384fcb94c80bae72dd8efc2db14742828bcf1f018bdddd1d41fc4c037b2a2225

    • SSDEEP

      24576:PaUxvxK4nXQEuJhZMPfpwAuTJOmzORONakqXRlaL8TsJyyMptS:5JKyXvuDUfUHTNZwaL8IJyhps

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks