Overview

overview

10

Static

static

5

SecuriteIn...27.exe

windows7-x64

10

SecuriteIn...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe

  • Size

    22.3MB

  • Sample

    241019-s1bvxatclb

  • MD5

    c1b51dbd3b3b55a8af24abbf3ef8050b

  • SHA1

    cb0f2984d2b91f6b9cc408ef9aaa676d364daeb7

  • SHA256

    3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027

  • SHA512

    5ef84faabb32e974e874e5f12df0b7e5f0d8ed7102ce90bd2239484a52d9c49c87c1c61cb1ce95d9eacc7004df52551b5da86ecc0b844f84d5eefb8f46ea40c7

  • SSDEEP

    393216:HkCtFKocM21vr0SkISu8mzhTx8r1mmuBka7Z+jXmoU4zJHTJRykR1dHA4L9WMVNe:Htcm2vJzhTx8QPT7QXNnVTb5DLjNWnz

Score
10/10
rmsdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe

    • Size

      22.3MB

    • MD5

      c1b51dbd3b3b55a8af24abbf3ef8050b

    • SHA1

      cb0f2984d2b91f6b9cc408ef9aaa676d364daeb7

    • SHA256

      3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027

    • SHA512

      5ef84faabb32e974e874e5f12df0b7e5f0d8ed7102ce90bd2239484a52d9c49c87c1c61cb1ce95d9eacc7004df52551b5da86ecc0b844f84d5eefb8f46ea40c7

    • SSDEEP

      393216:HkCtFKocM21vr0SkISu8mzhTx8r1mmuBka7Z+jXmoU4zJHTJRykR1dHA4L9WMVNe:Htcm2vJzhTx8QPT7QXNnVTb5DLjNWnz

    Score
    10/10
    rmsdiscoverypersistencerattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks