Overview

overview

10

Static

static

7

df3c28e2ab...d3.exe

windows7-x64

10

df3c28e2ab...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5543ec7918879f075e2714ba2aa7995b.bin

  • Size

    16.6MB

  • Sample

    230730-bpfahsgd6v

  • MD5

    72a14dc6ae816974d0374d676be379a0

  • SHA1

    6f184b28724d0de72c0bdb9700559cc2a47ee981

  • SHA256

    14ac54a1c7f49e78624c567b449e94b39cce27b667f3fadf4f998e85b164d0f4

  • SHA512

    90ec850ff184e0e07003a404280bb4272a3b36b3d04321bee9d76933de97526a9eec3e78b3c3747170564a86a29b6b06a8f7c0fe65394d89af6a2c94aa9fff05

  • SSDEEP

    393216:3pWwBSybdHxPQvw2dhNE1B0Kj1LTnj3uGPU+265x63SyC3aYLI:g0Syjoo2dnE1B0IjuP76f68hLI

Score
10/10
rmsrattrojanupx

Malware Config

Targets

    • Target

      df3c28e2ab0948020e93b8850dfc16b842f2ed5ce7ebf18c5f536c0cabbae2d3.exe

    • Size

      17.1MB

    • MD5

      5543ec7918879f075e2714ba2aa7995b

    • SHA1

      e72fc9f9fa3030ecb9e71ee81d9b1f301717db0a

    • SHA256

      df3c28e2ab0948020e93b8850dfc16b842f2ed5ce7ebf18c5f536c0cabbae2d3

    • SHA512

      53fc8e43b5ec22666ccda2a3c212cfb0ba366d266ee290ca9e6be232b0919048e427abe843715014a6ebb8a62a61fbdab1ae6327215a931cca340900ced1a3ee

    • SSDEEP

      393216:s4wctNG7SXLKhzMEOzMjjZlguA44g7Li70+VVuNcPN/S6nr2tAj:VwJGLYPnzguA44gHZUNK6noAj

    Score
    10/10
    rmsrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks