General
- Target RMMClient.zip
- Size 2.3MB
- Sample260623-apt81ahx9y
- SHA256 4a5f5861e0c1b4c39d090afe16d25079e29967a6d7298ffea9dcd0370af42d05
- MD5 f2caac1ca2a2d9dfc6c8dc5dbaddb35e
- SHA1 dd9dff4f227811f71e48294321cd2df1f5d6cc92
- SHA512 3f4d92585356ac8a3ab3f0c31240f3e1878e96f752d38ca102b8ab2c2473792c3edd1675a38155fcc33a4c908f8578729fe05a999939efb89864a1df90d01253
- SSDEEP 49152:NYePSK3hn8Q8E7/V53RZ+sDhygo9+ZHKccrP+w2XusZYo3u61bN/R9go9pOhlIu:NBhEK953R0stJo9i5pZYo3jN5ao90hld
- TLSH T12AB5336552AC3B78D0A938B42646E2FCE1F32DD6264E8E8A424D97F43AD4BF7450C05F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RMMClient.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
RMMClient.exe
Resource
win11ltsc2024-20260617-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target RMMClient.exe
- Size 5.8MB
- SHA256 62fb046372d16c11c57747723db6645ca6686cc5faed03335c04d98a5db78a84
- MD5 a944b8bcfc156f0ad6b52a8553b5fa09
- SHA1 759c118f2456a69f0a6a7102cd14fa5dc2d356d3
- SHA512 c2d10f7b25a13fb1b15e3c6a058f147ce3ceb419c0c03d02b0ebfe96a8cb41ad58962399b22aeabac2cd883fb59b8992f843dbca6e75e0f9fa7423c6b0025a48
- SSDEEP 49152:eWJsZT9OMhuSgA8er7lWzHLrMsgMlv+XPs9F2Ml6c6Z2IhEjGWNVFPN8S:xJsx9Oq0XrMElmfs9FzP02pFiS
- TLSH T1D6567D13B7C4643AD4A71A3B8C3B9648683FBA612E15CC4B7BF40A4C1F396816D36B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.