General
- Target RDPWrap-v1.6.2.zip
- Size 1.5MB
- Sample260606-j63fdact7n
- SHA256 35a9481ddbed5177431a9ea4bd09468fe987797d7b1231d64942d17eb54ec269
Score
8/10
Malware Config
Targets
-
- Target RDPCheck.exe
- Size 1021KB
- SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
Score8/10-
Modifies RDP port number used by Windows
-
- Target RDPConf.exe
- Size 1.0MB
- SHA256 3c0e5d6863b03283afda9bd188501757d47dc57fc4bba2bdbb0d9baa34487fe0
Score8/10-
Modifies RDP port number used by Windows
-
- Target RDPWInst.exe
- Size 1.4MB
- SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
Score3/10 -
- Target install.bat
- Size 458B
- SHA256 022364ee1fce61c8a867216c79f223bf47692cd648e3fd6b244fc615b86e4c58
Score8/10-
Modifies RDP port number used by Windows
-
Modifies Windows Firewall
-
Server Software Component: Terminal Services DLL
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
-
- Target uninstall.bat
- Size 249B
- SHA256 083cd340c800cc021d4a59388680ce0e7ab0f8b998e67def6a507070e7fa01b7
Score3/10 -
- Target update.bat
- Size 249B
- SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1