General
- Target http://rustdesk.com
- Sample260801-pal2eaam4t
Score
8/10
Malware Config
Targets
-
- Target http://rustdesk.com
Score8/10-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies service settings
Alters the configuration of existing services.
-
RustDesk remote access tool
RustDesk is an open-source remote admin tool.
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1