Overview

overview

10

Static

static

5

3b328d4649...27.exe

windows7-x64

10

3b328d4649...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1b51dbd3b3b55a8af24abbf3ef8050b.bin

  • Size

    21.7MB

  • Sample

    241021-ca4j8ssgmc

  • MD5

    1b7f9c556b75d3136467f837cb6ffea9

  • SHA1

    f506909aab6e6bd18d5ed7e707f2a18a19633834

  • SHA256

    97db6d0cceed80a41cd6ef05e9fb3736d4707a62b09130f6706546665908ff98

  • SHA512

    e72d5163cdfc1a5537d074803aff12474b6b0ec602fb1dd4f357cb15bf8a3f16d6253caa9d1538f6ca7d9af0c9a8f35554fb11a1db807ffdb2bba67f7c48c2f9

  • SSDEEP

    393216:S+PU4+g2t90IVmsuJiu7qWnX0fjtRQww2OV148nkqqWvhx:S+P9hW3hWnXGT0hPnh9

Score
10/10
rmsdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027.exe

    • Size

      22.3MB

    • MD5

      c1b51dbd3b3b55a8af24abbf3ef8050b

    • SHA1

      cb0f2984d2b91f6b9cc408ef9aaa676d364daeb7

    • SHA256

      3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027

    • SHA512

      5ef84faabb32e974e874e5f12df0b7e5f0d8ed7102ce90bd2239484a52d9c49c87c1c61cb1ce95d9eacc7004df52551b5da86ecc0b844f84d5eefb8f46ea40c7

    • SSDEEP

      393216:HkCtFKocM21vr0SkISu8mzhTx8r1mmuBka7Z+jXmoU4zJHTJRykR1dHA4L9WMVNe:Htcm2vJzhTx8QPT7QXNnVTb5DLjNWnz

    Score
    10/10
    rmsdiscoverypersistencerattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks