Overview

overview

10

Static

static

7

404cf289d6...26.exe

windows7-x64

10

404cf289d6...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    404cf289d6ecaae3f2d6e8e557f7f84f750693386e52bec585c7bf2fd79fdc26.exe.zip

  • Size

    10.6MB

  • Sample

    231002-ntv8rabc69

  • MD5

    6538ab5a1646e23ea0b4796f3dab9653

  • SHA1

    cbd7553ef3c51362d8c65a3f8c87214bf06820ef

  • SHA256

    80e8e505fef299c54b83afd276ef7a5b00af6e811934fb58df5dc9e21bde2c2b

  • SHA512

    d21a773253eb72930a358cf6e462f9603a467847e8dd778879bc1c99b2ca4b257d09b980e982638fd2d23c73f5601e24443f7f73edd3f4802967b7a9f8a151df

  • SSDEEP

    196608:FSwaUMazOtoh/urfy6ou2yqukRey2Da6jRPSDYJgeWbDNAK7Eq+STYKxPf2:FSwaUgC5YokkRey0PEYJv77WTYG32

Score
10/10
rmsrattrojanupx

Malware Config

Targets

    • Target

      404cf289d6ecaae3f2d6e8e557f7f84f750693386e52bec585c7bf2fd79fdc26.exe

    • Size

      11.1MB

    • MD5

      1e00a409afdf67c76912258b30ad441f

    • SHA1

      677c6acda178ff2638ebe68189374221faad1a05

    • SHA256

      404cf289d6ecaae3f2d6e8e557f7f84f750693386e52bec585c7bf2fd79fdc26

    • SHA512

      a2adbd72925888889d2c1cb1febab014669576957bd898551da6bb628041a216e4b372c0171dd279cb3045f30948b50cf11f6932129041c2ba058bb08fb5e8bd

    • SSDEEP

      196608:IlMUwq+egmNsFo1uXfAMYIdx9LHbepuJs0ZQUOWCH0LekaL0JPo07r:IqmgmNsFNXowdx9L6MZQ3W8RXQJg0n

    Score
    10/10
    rmsrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks