rms | 3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe
Size 22.3MB
Sample241019-s1bvxatclb
SHA256 3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027
MD5 c1b51dbd3b3b55a8af24abbf3ef8050b
SHA1 cb0f2984d2b91f6b9cc408ef9aaa676d364daeb7
SHA512 5ef84faabb32e974e874e5f12df0b7e5f0d8ed7102ce90bd2239484a52d9c49c87c1c61cb1ce95d9eacc7004df52551b5da86ecc0b844f84d5eefb8f46ea40c7
SSDEEP 393216:HkCtFKocM21vr0SkISu8mzhTx8r1mmuBka7Z+jXmoU4zJHTJRykR1dHA4L9WMVNe:Htcm2vJzhTx8QPT7QXNnVTb5DLjNWnz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms discovery persistence rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AgentRunOnce = "C:\\Users\\Admin\\AppData\\Roaming\\Remote Utilities Agent\\70620\\AF0B95CED3\\rutserv.exe"	rutserv.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	rutserv.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4396-12-0x0000000000C50000-0x0000000003C35000-memory.dmp	upx
behavioral2/memory/4396-76-0x0000000000C50000-0x0000000003C35000-memory.dmp	upx

Executes dropped EXE 4 IoCs

pid	Process
1812	rfusclient.exe
3980	rutserv.exe
1220	rutserv.exe
3528	rfusclient.exe

Loads dropped DLL 4 IoCs

pid	Process
1812	rfusclient.exe
3980	rutserv.exe
1220	rutserv.exe
3528	rfusclient.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023c9d-56.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	rfusclient.exe
1812	rfusclient.exe
3980	rutserv.exe
3980	rutserv.exe
3980	rutserv.exe
3980	rutserv.exe
1220	rutserv.exe
1220	rutserv.exe
3528	rfusclient.exe
3528	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	rutserv.exe
Token: SeTakeOwnershipPrivilege	1220	rutserv.exe
Token: SeTcbPrivilege	1220	rutserv.exe
Token: SeTcbPrivilege	1220	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3528	rfusclient.exe
3528	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3528	rfusclient.exe
3528	rfusclient.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3980	rutserv.exe
3980	rutserv.exe
3980	rutserv.exe
3980	rutserv.exe
1220	rutserv.exe
1220	rutserv.exe
1220	rutserv.exe
1220	rutserv.exe
1220	rutserv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1812	4396	SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe	87
PID 4396 wrote to memory of 1812	4396	SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe	87
PID 4396 wrote to memory of 1812	4396	SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe	87
PID 1812 wrote to memory of 3980	1812	rfusclient.exe	88
PID 1812 wrote to memory of 3980	1812	rfusclient.exe	88
PID 1812 wrote to memory of 3980	1812	rfusclient.exe	88
PID 1220 wrote to memory of 3528	1220	rutserv.exe	98
PID 1220 wrote to memory of 3528	1220	rutserv.exe	98
PID 1220 wrote to memory of 3528	1220	rutserv.exe	98

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Application.Agent.H3XSG6.10460.29227.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe" -run_agent
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe" -run_agent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3980
  - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe" -run_agent -second
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe" /tray /user
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eventmsg.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\eventmsg.dll
Size 57KB
SHA256 badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2
MD5 382f1f40ace9eb75f55400d4bea1dbf6
SHA1 94176ea4b9529c377bbdec1cb70458691b2efade
SHA512 3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c
SSDEEP 768:rDb11m1u0/h46F5BHk++oJAj7kqMJSxtr2xnh2END:rVl6hzk++oJY7ku/4hX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libasset32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\libasset32.dll
Size 8.8MB
SHA256 c127f79b4996890a01986f88b4e2076ff7cdb8b6de01092c548b3f28aeda35dd
MD5 ec1498f406642076468424ef2f45c452
SHA1 4ab87728753c802273ad96f5567ecabfe1274465
SHA512 df23385529ccf209478ab64756971e242caeb6c9157605bfc4c8b77bbc8af588f54c90b9fd3814372dd7f226edffb4425516eba296881ef5230bb5a9d591f60a
SSDEEP 196608:4L7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wKl3bc2EeJUO9WLcb0T:ylOJDm1Lrc2EeJUO9WLcbU
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcodec32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\libcodec32.dll
Size 6.8MB
SHA256 7c12b161b9f1be77a852cab4979fc0dc85f0e895d59d2f82622e573b9b00f860
MD5 57d6a827675eebf81b140724fd7c6754
SHA1 ebd29678e93aeef160bac2d62d5112823bfca54e
SHA512 8fafc097f194fb63086765ffec8aa110ac50774d340fb683181072e76b23e87dbc6ae22cd7247a2aadbb52a00f871b5bef847b51009326d0eaf78e2ee335e757
SSDEEP 98304:rRE7yGktThDyt6666666666666666666666666666666x666666666666666fwwd:hGktThD0TGh/fTCRwlRvZG3XYBVXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

licenses.txt

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\licenses.txt
Size 19KB
SHA256 4ef24da2e7933364af0c7918207927283d0b7664c615b888cc80843d7a62faa4
MD5 11b4de5dc2e474660c966c79bbcc0704
SHA1 b921b50c8e4f68e2cdc76e00bbbfbdf479610b41
SHA512 22e6a9254249647858e5e2c6f324cf0b7dcc9fcad9438453a0b966813f14102fb73bc9c40a037da9a1edea6c1f4ebca4ab71e69219730dd57affaa0ed9c83512
SSDEEP 384:8vGt7E1Onas/O5yo0tkKXsl8rsxrsHbpeeYgr3rNajA8JjNwrFNrsmrsMdxeeYgP:81OnasW5ybkVyy9eYgb38JpwBNhPkeY6
MD5 SHA1 SHA512 SSDEEP

Submit Download

privacy_policy.rtf

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\privacy_policy.rtf
Size 139KB
SHA256 1fcb0c18d74b4157752a5776ca47bf31f893453b4bcb82ba67b402769d054c26
MD5 b6d5dd2e4b2b3163f6bad087aa9f2ba4
SHA1 a9ef4821812d21c6bd93c9bc262494331d8eb130
SHA512 06b30fa94a1177c08dbcdf2251f2e48640bfe6403849d99af5522e0dd6e6978d9d30abc3d1023498b51cd9833ef9dc9845b73310cad2cd29650379f6f7c80b9b
SSDEEP 3072:whBk6AJAB0A0JcfGiYH6kZNUFrgXVbwRdi7mbXUiZmoXYSFRdXvYkifGtGJFbxUm:MS6VFr8pwRdi7mbXUiZmoXYeRdXvYki3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe
Size 10.8MB
SHA256 6a9cd931c9e8c4fcd39dcbfe09d7b94d367f31d22ed153239bd6fdece6e58377
MD5 6b9f07a3ee75fb38eb7fd9bc8a96ae02
SHA1 4c14f38f2d92bbbc3269dadfed870246eba2ebfe
SHA512 5d5c1adefb0d21b03410de27a9de337028b3084ae9fa357708b0f8ec096cc6785aa7289c8ac05a8ea50e48b23f8ba6d4186d5b7da9ab1fe80af8289f74bed76f
SSDEEP 98304:kp3OQXmpNiSWvAc2QanCmB114QQBO8+tAzD315S+jjPlqaWWWOdg7Hvv+Usz:kR5WpH7nCo1GZ+tcDjSEjPkWPKDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe
Size 21.0MB
SHA256 e3d1f9b01467d3013ae4612ccf577830a68b5e2e3b55c7fecba47cb88a031275
MD5 9193d8f7d011b0687ab90a8cd9b8fa5b
SHA1 62358120d0e3c9602f97ff529f6ba50c82903284
SHA512 45eea8d4a36ca8f215bd2cba0bb603ac95d181be4f188f56cdaa429d8e8c0523747d136fd5f9876bd8465b68f04c5e7c3fcfdd0de13d65c087e14d2e74d33205
SSDEEP 196608:kb4QNmvlZya+v+1ekzJuo7/qgaBN2R4w4jZsV3RvMNfGKPkB8d/UP+6:E44mvl0vyekzJXqdHY3RvDKP/ZcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\vp8decoder.dll
Size 384KB
SHA256 851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718
MD5 8e643fba05dbd17e52b0f57930a2b759
SHA1 55e11d1cc910700da3a35ba55dc2985f3795c4be
SHA512 266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6
SSDEEP 6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwch:EI8tiDOzyH9H8Tu6h04fZMZoMPuvfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\vp8encoder.dll
Size 1.6MB
SHA256 1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400
MD5 e58922447d2d0a9c007ccdca2a37cd81
SHA1 56dfa225585db1e31bea28a8225dfce18a4c0625
SHA512 cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82
SSDEEP 49152:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmmux.dll
Size 264KB
SHA256 1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4
MD5 696b0057893c38580911c0579a9909b0
SHA1 59c22298a5c37ca26999acac9e16822247cdfc47
SHA512 38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b
SSDEEP 3072:XW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTg:XWSfr7sXSmPDbKPJ6/AsNk+Dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisdecoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmvorbisdecoder.dll
Size 369KB
SHA256 2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de
MD5 170c0540946feeb20199d9a594e11879
SHA1 ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd
SHA512 33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa
SSDEEP 6144:qaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtwl1:yoPH0GgEp0gVd1ValsQXsHy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisencoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmvorbisencoder.dll
Size 864KB
SHA256 f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721
MD5 7a8acedc516cc199f7b56ca09def1ab0
SHA1 f0579f76bae11358f4efa0d4a2aa46a7c667865c
SHA512 5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f
SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNd:hYF+Eyx2lzujtEIYRc1cQmsGa7ONd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-127-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-157-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-186-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-147-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-137-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-152-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-181-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-177-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-121-0x0000000073790000-0x0000000073E3A000-memory.dmp

Download

memory/1220-120-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-172-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-167-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-162-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-142-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1220-132-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/1812-85-0x0000000073790000-0x0000000073E3A000-memory.dmp

Download

memory/1812-84-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/1812-79-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/3528-125-0x0000000073790000-0x0000000073E3A000-memory.dmp

Download

memory/3528-164-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-139-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-149-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-134-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-154-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-129-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-159-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-184-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-144-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-124-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-169-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-179-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3528-174-0x0000000000050000-0x0000000000BCE000-memory.dmp

Download

memory/3980-87-0x0000000000AB0000-0x000000000206D000-memory.dmp

Download

memory/3980-88-0x0000000073790000-0x0000000073E3A000-memory.dmp

Download

memory/4396-25-0x0000000004500000-0x0000000004501000-memory.dmp

Download

memory/4396-12-0x0000000000C50000-0x0000000003C35000-memory.dmp

Download

memory/4396-76-0x0000000000C50000-0x0000000003C35000-memory.dmp

Download