Overview

overview

10

Static

static

8

c569486f1c...e2.exe

windows7-x64

10

c569486f1c...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c569486f1c29e1ac32999c682c6e32667d9e30d10879eba649a44cc7a530d0e2

  • Size

    3.4MB

  • Sample

    221128-lg6gvaha8t

  • MD5

    bd24c43e22dd3f94763301227fcfaee4

  • SHA1

    4751e53b9427b17f0dcc11ccd0f8a6867295fc5c

  • SHA256

    c569486f1c29e1ac32999c682c6e32667d9e30d10879eba649a44cc7a530d0e2

  • SHA512

    60c4bf3c419549d9cabb233ffb0e2aa0c4a6e00df1d9a94cbbc938a85e9becd71f3137b1ed9cfe1fb48ef62e3b58a670dc0c2308304693caf308465fcf84aefe

  • SSDEEP

    98304:W23AzXk1YNwo3rtNJ7nRYorYHcdCUfxV:WeAzXSO3ZX7morqEb5

Score
10/10
rmsevasionrattrojanupx

Malware Config

Targets

    • Target

      c569486f1c29e1ac32999c682c6e32667d9e30d10879eba649a44cc7a530d0e2

    • Size

      3.4MB

    • MD5

      bd24c43e22dd3f94763301227fcfaee4

    • SHA1

      4751e53b9427b17f0dcc11ccd0f8a6867295fc5c

    • SHA256

      c569486f1c29e1ac32999c682c6e32667d9e30d10879eba649a44cc7a530d0e2

    • SHA512

      60c4bf3c419549d9cabb233ffb0e2aa0c4a6e00df1d9a94cbbc938a85e9becd71f3137b1ed9cfe1fb48ef62e3b58a670dc0c2308304693caf308465fcf84aefe

    • SSDEEP

      98304:W23AzXk1YNwo3rtNJ7nRYorYHcdCUfxV:WeAzXSO3ZX7morqEb5

    Score
    10/10
    rmsevasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks