Overview

overview

10

Static

static

7

19f95db09b...25.exe

windows7-x64

10

19f95db09b...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe

  • Size

    17.2MB

  • Sample

    240616-k8kh1sxgpg

  • MD5

    4fb2e04c13d6e6f444639b0ecc9a69c3

  • SHA1

    9884b3332ee0c0d3eb739c8c77f46f6385005198

  • SHA256

    19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25

  • SHA512

    cf8969c5c69b5210a092f74d55c728d2ad067a6302bb793491f218918dfa6fb21cb7ac3b3f8e81e05ebbded9a3c44cf780069e21d85e69481080f0e84130b670

  • SSDEEP

    393216:K9F87Bt4t6JCvP7ZfKBbd78rjI6ogQINazTsvzfUuEQ9L+z37:GUBtK82P7ZfKBh8rjI1IyTsvQu/9L+f

Score
10/10
rmsrattrojanupx

Malware Config

Targets

    • Target

      19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe

    • Size

      17.2MB

    • MD5

      4fb2e04c13d6e6f444639b0ecc9a69c3

    • SHA1

      9884b3332ee0c0d3eb739c8c77f46f6385005198

    • SHA256

      19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25

    • SHA512

      cf8969c5c69b5210a092f74d55c728d2ad067a6302bb793491f218918dfa6fb21cb7ac3b3f8e81e05ebbded9a3c44cf780069e21d85e69481080f0e84130b670

    • SSDEEP

      393216:K9F87Bt4t6JCvP7ZfKBbd78rjI6ogQINazTsvzfUuEQ9L+z37:GUBtK82P7ZfKBh8rjI1IyTsvQu/9L+f

    Score
    10/10
    rmsrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks