Overview

overview

10

Static

static

3

bb4b88da25...09.exe

windows7-x64

10

bb4b88da25...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb4b88da25e06b8daf7cd814f772849f0e28a1c8eba92b67477a31bce5636309.exe

  • Size

    21.0MB

  • Sample

    240126-ny59hsechl

  • MD5

    4747b6f3d7f498abdc341e2fa7441685

  • SHA1

    c7eeafa51d7834a1a18ebeb552693b6f9e6a1340

  • SHA256

    a081a0418491a5c5ef0d8a5cde2fc0617ffc0c4a62b88d18e2f2557b50e1fbab

  • SHA512

    352635157ac33b93438aeda53a38ec290533e3d4515a6a122d8b79f2213c6afed1421710379627261f8ab8d22f08517267e8abed0829b890176b27320ceb7214

  • SSDEEP

    393216:1FHWNZQ7v3RvjnbdV8l5DdkM9lUXFLMVp:1FZZvjnRODYVmp

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      bb4b88da25e06b8daf7cd814f772849f0e28a1c8eba92b67477a31bce5636309.exe

    • Size

      21.0MB

    • MD5

      4747b6f3d7f498abdc341e2fa7441685

    • SHA1

      c7eeafa51d7834a1a18ebeb552693b6f9e6a1340

    • SHA256

      a081a0418491a5c5ef0d8a5cde2fc0617ffc0c4a62b88d18e2f2557b50e1fbab

    • SHA512

      352635157ac33b93438aeda53a38ec290533e3d4515a6a122d8b79f2213c6afed1421710379627261f8ab8d22f08517267e8abed0829b890176b27320ceb7214

    • SSDEEP

      393216:1FHWNZQ7v3RvjnbdV8l5DdkM9lUXFLMVp:1FZZvjnRODYVmp

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks