rurat | ec70c730cb6fa77cd7da6c61ed24348c6b277dc786ecac0e52e0f78784f2b5ed

Analysis

max time kernel
83s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
host-7.7.3.0.exe
Size 30.5MB
Sample260527-shdxjsbs2x
SHA256 ec70c730cb6fa77cd7da6c61ed24348c6b277dc786ecac0e52e0f78784f2b5ed
MD5 ec8b4c4a640f4672acc1b35d010814a2
SHA1 ecceaeda8069a5a044ca9c5571070592f4ebb639
SHA512 8c87d65ba3afa06c7c954f8b309f0b75a921f036ec88d3ca07af4f9f6425e961419fe79df9fc0662b1b6119ef32186ec667b47fff3dd3e82b233a06714b74469
SSDEEP 786432:srgCCo+KslvPXAagvy5Yv8WHMdr9a5n+eHuWzP:sri3VPXB5Y0WHMdr9a5n+eDP
TLSH
T134672382F2A4C855E8676231ECBADFFC052AFCA9DF21121B72D4BF0FB4725924815356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery rurat ransomware trojan upx

Malware Config

Signatures

Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3728	msiexec.exe
3	3728	msiexec.exe
4	3728	msiexec.exe
5	3728	msiexec.exe
6	3728	msiexec.exe
7	3728	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4440-4-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-6-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-7-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-9-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-19-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-33-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-34-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-35-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-36-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-37-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-42-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-143-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx
behavioral2/memory/4440-221-0x0000000000B00000-0x0000000004CC0000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 1 IoCs

pid	Process
2508	MsiExec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b580-134.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host-7.7.3.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007693c80d07c71b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007693c80d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007693c80d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7693c80d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7693c80d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeMachineAccountPrivilege	3728	msiexec.exe
Token: SeTcbPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeTakeOwnershipPrivilege	3728	msiexec.exe
Token: SeLoadDriverPrivilege	3728	msiexec.exe
Token: SeSystemProfilePrivilege	3728	msiexec.exe
Token: SeSystemtimePrivilege	3728	msiexec.exe
Token: SeProfSingleProcessPrivilege	3728	msiexec.exe
Token: SeIncBasePriorityPrivilege	3728	msiexec.exe
Token: SeCreatePagefilePrivilege	3728	msiexec.exe
Token: SeCreatePermanentPrivilege	3728	msiexec.exe
Token: SeBackupPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	3728	msiexec.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeDebugPrivilege	3728	msiexec.exe
Token: SeAuditPrivilege	3728	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3728	msiexec.exe
Token: SeChangeNotifyPrivilege	3728	msiexec.exe
Token: SeRemoteShutdownPrivilege	3728	msiexec.exe
Token: SeUndockPrivilege	3728	msiexec.exe
Token: SeSyncAgentPrivilege	3728	msiexec.exe
Token: SeEnableDelegationPrivilege	3728	msiexec.exe
Token: SeManageVolumePrivilege	3728	msiexec.exe
Token: SeImpersonatePrivilege	3728	msiexec.exe
Token: SeCreateGlobalPrivilege	3728	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeMachineAccountPrivilege	3728	msiexec.exe
Token: SeTcbPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeTakeOwnershipPrivilege	3728	msiexec.exe
Token: SeLoadDriverPrivilege	3728	msiexec.exe
Token: SeSystemProfilePrivilege	3728	msiexec.exe
Token: SeSystemtimePrivilege	3728	msiexec.exe
Token: SeProfSingleProcessPrivilege	3728	msiexec.exe
Token: SeIncBasePriorityPrivilege	3728	msiexec.exe
Token: SeCreatePagefilePrivilege	3728	msiexec.exe
Token: SeCreatePermanentPrivilege	3728	msiexec.exe
Token: SeBackupPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	3728	msiexec.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeDebugPrivilege	3728	msiexec.exe
Token: SeAuditPrivilege	3728	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3728	msiexec.exe
Token: SeChangeNotifyPrivilege	3728	msiexec.exe
Token: SeRemoteShutdownPrivilege	3728	msiexec.exe
Token: SeUndockPrivilege	3728	msiexec.exe
Token: SeSyncAgentPrivilege	3728	msiexec.exe
Token: SeEnableDelegationPrivilege	3728	msiexec.exe
Token: SeManageVolumePrivilege	3728	msiexec.exe
Token: SeImpersonatePrivilege	3728	msiexec.exe
Token: SeCreateGlobalPrivilege	3728	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3728	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe
4440	host-7.7.3.0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3728	4440	host-7.7.3.0.exe	81
PID 4468 wrote to memory of 2508	4468	msiexec.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\host-7.7.3.0.exe
"C:\Users\Admin\AppData\Local\Temp\host-7.7.3.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{4D59AA1A-B690-4460-AA93-1E9BFDD1A2B8}\installer.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3728

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DADA7EB3B2F90F5FBBA59548B3121302 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{4D59AA1A-B690-4460-AA93-1E9BFDD1A2B8}\installer.msi"
  2⤵
  PID:4244
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -config -instalrt
  2⤵
  PID:2192
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  PID:2300
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  PID:388
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  PID:2216
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /CONFIG /SETSECURITY
  2⤵
  PID:3360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1836

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
PID:1572

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
PID:2200
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  PID:4728
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    PID:1984
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray -instalrt
  2⤵
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59cf6d.rbs

Path C:\Config.Msi\e59cf6d.rbs
Size 16KB
SHA256 908b799170924a9077d3c0f1b943724df82e33fbdbffc1fbdd7a1bc59ba190fa
MD5 1a92ddb5b3ba04b8a9d1027ff8c9917d
SHA1 8ae65f5c4812b465acdd769fd875abcd1dc71587
SHA512 36c5b3db9a532b65a8e568315c9f7957ac11203efe3c924d7a850c82be67dba8da0483925f7dadba94a9f05d590b92d2a5f8480e7d90146868851252ab572837
SSDEEP 192:lnn2totot3mkb0xepciGqAevxVyIaxVy8C0G9Bq1ship:ln2totot3mAHvxVYxVxG9BY
TLSH
T157723F11AB04C9C3F6118AB7BB861F263332CF06A3AC431B56CD96355EC3B984E6D1B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventmsg.dll

Path C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Size 57KB
SHA256 badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2
MD5 382f1f40ace9eb75f55400d4bea1dbf6
SHA1 94176ea4b9529c377bbdec1cb70458691b2efade
SHA512 3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c
SSDEEP 768:rDb11m1u0/h46F5BHk++oJAj7kqMJSxtr2xnh2END:rVl6hzk++oJY7ku/4hX
TLSH
T122437C13D702C177C51A4AF868B660D59A3B7E611C255EF713EB88F80DDD3836E0E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 9.4MB
SHA256 299b3f5e49d3303e0a4793fee52a1165c340a560729115f1a4d421d6f0416fa5
MD5 5e5d28b2f2bbe4e7cab4e618795e5d2e
SHA1 1518a1ef3060da0b8b37ad3369efc51f65cf93d9
SHA512 7cebf0b9fe348606d3b8cd486a8cd0f9a49111b61a0b84039eb86c7a8fa8782edee87b90d2cd61127e7729b1eff1c096f1d2728e3555031be4d2302ad7d8951d
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/gqc2d:ImyhTWMWHc2EeJUO9WLQDh
TLSH
T1F7A62955EA8B28F5EE936771818BF33F5734AE00C636EFB7FA08D525A8336821905351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 7.1MB
SHA256 a025da3d554bbe23d73c629ac0429d98b05c6a0af2c4fc9590217349055fc099
MD5 f742f1e435e1cdb1c319efb53a6f3d08
SHA1 44540f94b19f80322afbd25fc3f522c50940b2b9
SHA512 a9a33cde374d2dbabbb02d0126fb1b9ea11eb52560d1440ff6fad632d38321cab1bfb7183b17d2fbb6c1909c9c58d8a809379d4f200b1ba8a9800423f95cfee7
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2N:ImyhTWMWN
TLSH
T17C761758EA4728F1FE635972865BF37F8B20AA01C421EEF6FF09E959F43351214093A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcodec32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll
Size 5.9MB
SHA256 a4a53244ea6bafa55c6f1c4b13da9a6a77e758842593e51b01b34dc137465930
MD5 cada7566aa85b9527028a81fcc335754
SHA1 5aa0ca6b593918773aacf980c1038b0f2b034ce8
SHA512 591a4abcbebb4cb0f9641bedd5f271fd4482317c74ca33fa81dfc0a03cdcd318c6049fa51b6918d43b3bf064070f13f461d00f360d7cf285797352bcc8c2995c
SSDEEP 98304:eWV9pglfgw7i6G6666666666666666666666666666666x666666666666666fwG:eWVklfgw7iEgBon00l67+M
TLSH
T131565C42FACB58E1D8D32BB4519BE33B9738AE15C125DB7BFB48DA15F8633815819302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 15.6MB
SHA256 7906a81b1dec372b4c232306678fda0cbc46db41e3db0c06b858d54d60cd7ab6
MD5 7b278a04998a55c694f3c559c93ea6d6
SHA1 574b1bd5d0499e4621f9ed5d1c6b8c58d9081c4a
SHA512 0f37327fe81971e147e15661e766728f6b4a60f66f1da6ca9772bb37a84c61f5109a75cb6c33e866b24b08d6f71a00b2443f9bbeb3fe8dd81ce65b8b4e083171
SSDEEP 196608:wSGMXyBKNfobRTbAyeAjfVhZZ0FjbrR5za:wrMXyKJobRTb3njd3SF3rTa
TLSH
T1E7F66D237285953AD0AB0B3A9937A754993F7E612E128C0767F83D4C7F356C02D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 7.8MB
SHA256 d2cc96e79a21a4c9222a723302caa05ab347efa7c8af71db5cea7e871d84bb1d
MD5 0d58904c5cb27629f499738e1fd88bf4
SHA1 5c9cafceb6c9a05f4e791fe00e6703fd6f07c5c8
SHA512 772926c5c9ae7ef2c9a8ace3cd6e4e40657233b55b1d8c7d5510750e9575259f0dfbc643869280d96e48fe333509afdef2c34de374971ff9d27656f16294b272
SSDEEP 98304:wSLKMXcBnqrOKljmGobwgXNdTb55W997J1fyB:wSGMXyBKNfobRTbAyB
TLSH
T1A1867C13B2C4653ED0AB1F3658379954A93BB6623B138D476BFC190C6F396802E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 21.4MB
SHA256 d8e6765d0dbfbdf436f88c7cac85476b41edd6ded12f24bb34fe3932737ba613
MD5 ddd4b884ebbfb34cfbde936159e3489e
SHA1 1feb04f1d48a70b79f70dc94daf62a10ec99648d
SHA512 05bfced1692b62a80cea55f03b6af5f4b75e5a97ba0a5b155384a26b5a9f67c8f400462faeb29a57b263f489ba65820fbde1f22aaae8614a3a4d13da12ec3d2c
SSDEEP 196608:RRL+UuGdwiu02guteFpDdOmcnojKqdXL5cB55/Jl9jsHCRe2X4:HLpuGpTitS5jjVu35/XZgCI2I
TLSH
T1B8378E03B385943AE16B1A3A5D37DA549E3F7E602A169C0B2BFC394C1F355803E2B657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Size 384KB
SHA256 851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718
MD5 8e643fba05dbd17e52b0f57930a2b759
SHA1 55e11d1cc910700da3a35ba55dc2985f3795c4be
SHA512 266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6
SSDEEP 6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwch:EI8tiDOzyH9H8Tu6h04fZMZoMPuvfR
TLSH
T157847C11A6828131D8FE05B8ACBCEE95222CEE0E9F744DDBD38C294959B21D15774FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Size 1.6MB
SHA256 1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400
MD5 e58922447d2d0a9c007ccdca2a37cd81
SHA1 56dfa225585db1e31bea28a8225dfce18a4c0625
SHA512 cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82
SSDEEP 49152:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
TLSH
T16E756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Size 264KB
SHA256 1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4
MD5 696b0057893c38580911c0579a9909b0
SHA1 59c22298a5c37ca26999acac9e16822247cdfc47
SHA512 38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b
SSDEEP 3072:XW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTg:XWSfr7sXSmPDbKPJ6/AsNk+Dy
TLSH
T1B1448E013685C075E9EF027198796B6A18FCBD724B64C6CBE7881D4E1E312C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Size 369KB
SHA256 2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de
MD5 170c0540946feeb20199d9a594e11879
SHA1 ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd
SHA512 33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa
SSDEEP 6144:qaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtwl1:yoPH0GgEp0gVd1ValsQXsHy1
TLSH
T1BE848C01B9A2C57ED4EE017018AC7A4BD9793A6D07B8CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Size 864KB
SHA256 f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721
MD5 7a8acedc516cc199f7b56ca09def1ab0
SHA1 f0579f76bae11358f4efa0d4a2aa46a7c667865c
SHA512 5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f
SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNd:hYF+Eyx2lzujtEIYRc1cQmsGa7ONd
TLSH
T18915A213F9929D67D7E802310091F5355622BCBCC3E35AF73B8476FD39A6A805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\ProgramData\Remote Utilities\install.log
Size 639B
SHA256 ea6bf10dc3ec506426976206d77d761ab15307693bca1036f6313b64e0dfd8c8
MD5 09fe9d1c7355c806054091bd9d2f9bdc
SHA1 da20aea44c040837919b61ae41c024e3cacf4391
SHA512 88d79a99f85a7489f56acf0f56dec6247f6aced25738f4bb0578f4d95160f0164f73f730f85d018db556f60da2fde052141ba7f8c1a23dd3c3d9b540f341b117
TLSH
T158F0ADCC57F3A2372E1212852F5EE7DA596D1D641862131831A3D6889B618AFC3D2871
MD5 SHA1 SHA512 TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734
Size 2KB
SHA256 67074b6abf9269cd3be0cd740de8ce3bf5eafbcc7d80d3d24aef34af526b1952
MD5 00c3e9a166fadaf6963cb6f4d0e1a713
SHA1 8d2985b26d6ab36e736dd8ac5ee479df379c64fa
SHA512 ba50e197ab4b69506a1ca234ae356ef503f2a716920751774773516b50f38ec1eff0859cd7b2d0764eac47aff827ae9865b6f36ab4165ed85576724d7a5f01b5
TLSH
T10C41EF4C91513523E148BFB2DECABD8BCEB1B78267C9C50F9DA01E421425FC85F984A6
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F
Size 1KB
SHA256 f78c2288848e3c3fe0dc5d7b0345044ab3d44f0e54a088f0f185d5245b6d7364
MD5 90fc6eae24d950e2bee6a4b39a82579c
SHA1 51c298b98cec943d68c24c2bb9bfbd1a3011d305
SHA512 255a9888ed9ba43fa2ca2a0b75735b94f112e5ea8066920110c0ad98d6f91a9b00e8f34fd83c78f3297a96d90f5214e9185f9ef1cd0a86aa42fe569d0c27945d
TLSH
T1EE31F8CA022C2C866A8ACE289CC799157C25F4F479BCA411127B8375E8103F35FB902E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 5f2fe9bb80f64b0b967df6fe9814a046b5f9cac48a06d56843142661815d04df
MD5 7ec7aafb1c6641954556303c836c7909
SHA1 2730467a6a9d9c915d810d8da48f122467b2372f
SHA512 023664a07448e890715ed594838e89bced4e391f3145de0165cd3c0aa9a42c86f3f0e66a19780df0e0fe95c904b24eac164a60076b75d3b34858a8be2dcd4e57
TLSH
T18E31182B1F2C79118E57CE502AC8FA721DB0C9D12DDB24663114992F2C80BB60F1A90F
MD5 SHA1 SHA512 TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734
Size 192B
SHA256 f04addd03a607cbe16d97cbe4c6fb6332fc8e1a94d9ffb45522716e2712c1987
MD5 0d21ea201cce341ea66d187f49ee45df
SHA1 87c41d0d4e4c17e7ed9ff1994a4b4ecce1ca96e1
SHA512 3b8c7d7d62e063f9f670d1afab652668ed5b5ddbe49509d38fdcddda12ce8bf80e2dec61606501f3524bd6f713f1bc97b6c82c393a8966a794e0e80df7923ce5
TLSH
T1E1C08C11A7B49316F42506BA3D802CA75BB25F838323CB5D0B20320C783AA448AB0F12
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F
Size 540B
SHA256 2b7c1fc2b5a7845c487c42a2430be6553b8af3623ed6d5bc4a5e5584c0c6591b
MD5 537db3a114bb1dd4f866af636c83f489
SHA1 1f4ea2edf9ebae82205ff1a1419a0db3492b1ef4
SHA512 c73a8229e6ef42e2ab57c7f4a7622eecd9e79dbc1cd95849f08474388aa4afe90fe144b84a154b7b5f476acb304f5f777fbc16a1c119203910529e59140ae04a
TLSH
T12BF0E26454BE021FF072CB3856C0E89AAD6DFA132869E65505A98749BD22E806C53A3A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 81c80a0e04751defde25fb9d6217e36884a56bb644406a65d0d242ccf2ca2ba1
MD5 93c7c323e9416a18d013ffc2434bd0e7
SHA1 34165d70ad2f2fb37e6238182ea34a0de979bffb
SHA512 50b77f6ae27d414230c8b440173bc9d949fe382e8f1dd9010f20e42a1a72fe8c08c325c0e648e646e253e075d64c0585f73dc27e301b59c37db637a85cfa27d3
TLSH
T1EEF0D43804FA012EF876CA750AC85517DD16F9132C71972522A40B4D5C32B00AE9743D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI83.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI83.tmp
Size 649KB
SHA256 085eacfc60a533c33950ac55f17a3afa5b7baf6e5ba73ec112adf5ed88177175
MD5 9130f41097ee2c54f979bf580706d62c
SHA1 8a31f3e18563adfef88bf9c540dc6cb7bb53ad14
SHA512 ee2f5e3ff3dbcf5dde420398193c1951a56dd8f85b8eb6c0682b89e0744e59bd56d38de9f183d93bfeb5b952e5c0116adb657cbef93e0852a05af5fa1c1088f3
SSDEEP 12288:pvEQx02n8dTBNzQGy5w8Z0IrQ9Eht74mUJEUAuh4Mqvggj+OC:pvEQiTdD2FMmUuUsYc2
TLSH
T11DE48C227A84C071E67F24326838D2715ABD78311F729BCB1798097E5F744C1AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.msi

Path C:\Users\Admin\AppData\Local\Temp\RUT_{4D59AA1A-B690-4460-AA93-1E9BFDD1A2B8}\installer.msi
Size 28.8MB
SHA256 7eb4cc80446cf38ba290e0bdd97738179d4d9fa99be654e2dceb7e8761b64744
MD5 6c263505dd1163341754d3a5ef1d50da
SHA1 5514dcbf6e57d766eeaa2ee8a8236aa0419b3732
SHA512 322c9174c8a085027f27d728db9b6e5f3282c1ebb0fbbf24ea01a5f2868b510b77d28b6dc30b2e43d646299f69e8dc5a05155afe495079fb5d5b0eb723375b2d
SSDEEP 393216:eYamhN9mDlEYxIqwFsRkwSasMPqwwVSelRz75HcV9WvSmnlDfIAtqPsvXCY8ryyB:e4iEQIqwFJ1aoHjRl8HWvn6AtM
TLSH
T1B9672382F6804036EA67163256F6DE38487DFC705F6123CF27D872396E728C15A3A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 23ee700078066782851d7c7d07b098011e4f4291470f535f17036301719596a0
MD5 8cce80a7d003b6ef25fa89f468ceaa09
SHA1 0b1df6d53f85c3a314c0eadc237869d0e5d8967f
SHA512 b7d20b5cd8f705117a112a518fb44dd44e396da4ade346451d3843fb52450e1713268273029ad3776169c4a0c4c3b78eb64bf379fbc80658c9045866fc7feda7
SSDEEP 24576:+2gmSp1UdoO/vvTLB2q+RknK/qpBA4eA22p9XpEqzRaIE2OvYR7d7nANh:f
TLSH
T17047C22436F92210E7F79E3CA8F0AA234D3A7D5B9C15DE8D05411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c9fa6f44-aba4-4966-a41d-34d1cade2f93}_OnDiskSnapshotProp

Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c9fa6f44-aba4-4966-a41d-34d1cade2f93}_OnDiskSnapshotProp
Size 6KB
SHA256 0ceaa8b3920d1e0581aedcb6ed28f2a3963106b02dd2b86f617fbe04f021c828
MD5 a48076e671b3cc8a4deb5e409a109a43
SHA1 d30c94583a7c48601ff4544a775124386cec4214
SHA512 2d2d224124dcad2205a28bf0230401f866b9a36fa7f7326c940cf8d7056aa948dd7ee7ee8e58bf20c31c8af5a219d3ea34b7bf821c85ae089f417ba499d9423a
SSDEEP 96:FDO4zwovc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:VTb++ZVmN
TLSH
T1A0D177185AE54311E2B3AB3128F18557A877B911EF33CB8E0298638E2670910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-161-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/388-162-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/1572-166-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/1572-167-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/1984-229-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/1984-228-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/2192-145-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2192-144-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2200-186-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2200-187-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2200-212-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2200-225-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2216-195-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2216-182-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2216-194-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2216-183-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2300-155-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/2300-156-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3360-185-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3360-231-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3360-184-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/3360-230-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/3360-223-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/3360-210-0x00000000000B0000-0x00000000016EC000-memory.dmp

Download

memory/4244-137-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/4244-138-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4296-217-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/4296-218-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4296-241-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/4440-35-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-37-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-9-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-36-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-19-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-7-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-143-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-34-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-6-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-4-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-221-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-42-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-33-0x0000000000B00000-0x0000000004CC0000-memory.dmp

Download

memory/4440-5-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download

memory/4728-214-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/4728-239-0x00000000003D0000-0x000000000140E000-memory.dmp

Download

memory/4728-215-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download