Overview

overview

10

Static

static

3

723a7e3f2a...18.exe

windows7-x64

10

723a7e3f2a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240726-csqq4azgpk

  • MD5

    723a7e3f2a293f526c2574cfad06b72b

  • SHA1

    54c9a81aa53962beb066402e63464f7b18d34273

  • SHA256

    d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec

  • SHA512

    a4183af1435af07da77d96ca992190d06d5c5bda37528a5c5a4aeb811aedaa6c26ebaa7d26347d066d92ce60f11e2c893b5ed0526e71daebd8d65aca2afdc70b

  • SSDEEP

    98304:YogY3IgMAk7BepFZXiWDoFA9hvfbDU+epbQ9DgG6O2kF2KaQ+02usPfdN:YS3IRRwp/Xi+KAjffU+epbytUkF9aQ+V

Score
10/10
rmsdiscoveryrattrojan

Malware Config

Targets

    • Target

      723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118

    • Size

      5.0MB

    • MD5

      723a7e3f2a293f526c2574cfad06b72b

    • SHA1

      54c9a81aa53962beb066402e63464f7b18d34273

    • SHA256

      d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec

    • SHA512

      a4183af1435af07da77d96ca992190d06d5c5bda37528a5c5a4aeb811aedaa6c26ebaa7d26347d066d92ce60f11e2c893b5ed0526e71daebd8d65aca2afdc70b

    • SSDEEP

      98304:YogY3IgMAk7BepFZXiWDoFA9hvfbDU+epbQ9DgG6O2kF2KaQ+02usPfdN:YS3IRRwp/Xi+KAjffU+epbytUkF9aQ+V

    Score
    10/10
    rmsdiscoveryrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks