672bac0dc07e883d09a424569d068da1064ad0d4eee5a183752b95ace3773fed

Sharing

Copy URL Twitter E-mail

General

Target
RSVP_Invite_access_2026_card.exe
Size 10.5MB
Sample260818-pmz4ssscpc
SHA256 672bac0dc07e883d09a424569d068da1064ad0d4eee5a183752b95ace3773fed
MD5 d5252357bfaea2ea3cfae15fe258c6fd
SHA1 a4c405d68ac56b082afb7796762a323ef331411d
SHA512 46084f1fc9520d7ce97bfae9deeaec8e2ada0fc0038a6258af038b437da63413bfa317bb8a09142e67e6b18d627ed53e55c43759cb77f3987b474fff62a1bdd7
SSDEEP 196608:+aZk+wxP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2V:sn0mzZFw5S9pE7Asjp29qIT0jarlZr8p
TLSH
T102B63347D9778DF0CA330B3890D21A6B3205980E485BF4C9E509277ADEF35AADD2879D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RSVP_Invite_access_2026_card.exe
- Size 10.5MB
- SHA256 672bac0dc07e883d09a424569d068da1064ad0d4eee5a183752b95ace3773fed
- MD5 d5252357bfaea2ea3cfae15fe258c6fd
- SHA1 a4c405d68ac56b082afb7796762a323ef331411d
- SHA512 46084f1fc9520d7ce97bfae9deeaec8e2ada0fc0038a6258af038b437da63413bfa317bb8a09142e67e6b18d627ed53e55c43759cb77f3987b474fff62a1bdd7
- SSDEEP 196608:+aZk+wxP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2V:sn0mzZFw5S9pE7Asjp29qIT0jarlZr8p
- TLSH
  T102B63347D9778DF0CA330B3890D21A6B3205980E485BF4C9E509277ADEF35AADD2879D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware trojan backdoor rat
- DattoRMM remote administration tool
  DattoRMM is a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 31KB
- SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- MD5 83cd62eab980e3d64c131799608c8371
- SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
- TLSH
  T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SimpleFC.dll
- Size 175KB
- SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
- MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
- SHA1 99778940e059238ca23a513e717d4db2cf34e606
- SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
- SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
- TLSH
  T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH
  T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsSCM.dll
- Size 5KB
- SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
- MD5 62efa7b730eb0523a026ea4325403b77
- SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
- SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
- SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
- TLSH
  T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 11KB
- SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- MD5 13deb9a0f4e4286df01abc85e1895e09
- SHA1 3174853b32407fd85220de844b390a18a8a76c97
- SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
- TLSH
  T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  AxInterop.MSTSCLib.dll
- Size 240KB
- SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
- MD5 0f581e56ed5ba500ce5d98d105b04a37
- SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
- SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
- SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
- TLSH
  T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  AxInterop.ViewerX.dll
- Size 40KB
- SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
- MD5 edc5e696c4ad70f0be6301f703ab3672
- SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
- SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
- SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
- TLSH
  T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  CagService.exe
- Size 19KB
- SHA256 eb209f6eccdebca405183de5f24ef34ee8c850615e6ab9f086f5a4fb6851e071
- MD5 975354d0a22c4a77e27624bfcb05777e
- SHA1 d4e71d00d95dede191e1347dd4bf284908705cd2
- SHA512 ee2def7352f16f71c15c863e0f1722ba69e8a3a7eabd49e7bf4d03c369a462f2a403b8ee00ea018aa2cdf4f3a689d2a2fadce2b10ce51353e6737bb77097be22
- SSDEEP 384:KYMQoDoU+94X9nmhJUqkpf5ZTJ4yIE1m2Jo:loDoi8at1F1m
- TLSH
  T17B92D611A3E84B66F6F76F7559720A050E32FE5BA871D34C26A4004F2AB3B81C971777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Common.dll
- Size 16KB
- SHA256 74e9ea4521981be2e6f2ed16ac290a7c02edda5a5c9667e73c81f6e26279e19e
- MD5 7c6b16079293813e00866903e5f3ddee
- SHA1 eed5c13066fc476290e2154c0f47b059b497696f
- SHA512 9b610cc410837bc6727004760bc9770ed463901867e2557336921e7657880386ad51aa7bdd2599a4a62b902cfa18e582318dbea5eff3efea646221b713827870
- SSDEEP 192:e6HEVOfEEHwZI9SZM/ozVSg8eiCKiomqsUwwOgcsdsCXJ0OQ3r8h+e3gbM4wMN2Y:X8RZI9AhN25kqsaORsdsOQ3r8owm21s
- TLSH
  T10B721B398A78C33BC6591A32F551CF6913B6974BB281CA9ACA14D85F3F033DA44059FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Core.XmlSerializers.dll
- Size 10.6MB
- SHA256 eb627549fa4ba8dfedbe22ab7dda5ef750ee29a588ae8760b73ff39f6af3cc1b
- MD5 839ebb0c02f5fa42a3baa3a6011f0b72
- SHA1 81fe569a2010ee2048d30d521f3258492a8cd645
- SHA512 ef42fa4b15b2e65f641954931273959e27e3542232beebbe6337ff3ef44584911a6c02e101afe63f069f6585435b437f75808627f07371a8dc3beb328185181f
- SSDEEP 98304:f8/TG3m4qfsloogYYDCs5akzP7YgZZu2U6F0FrT5hDXZe00W7:iT6m4Gslb/pP4bujzFv5h
- TLSH
  T186B630CC77E81E4BE4BF7F6215B15A119636FE2B4682E28F02E413B555B7704BC806A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Core.dll
- Size 2.3MB
- SHA256 4d47bbb4ff0b6739fb6e069087b6d73b0e2ebc173da9fa47a3a94fcbc506d9f3
- MD5 36fd5269d81b6296a49c84d139a6693b
- SHA1 ae05c3a1f049a8740339ad873a96c2e1c3cb61fb
- SHA512 60c6be00634b0c4585c8e3a2aa7065d84fb810e87237ee568efb35840385a31cb4ebd4de5bd51a4e2fdb35e7eedd23a5c1d58ba1e17f6ec3f201facfdc7ebcc8
- SSDEEP 24576:xB5iihsL26Ea3+X9aL8zi0nXR3X4D4u6/05pD6Tr0NuHo4o9M5qtyxGX+JaZX442:3kLisD5pDiYuo9
- TLSH
  T1DCB5D91026B0DA9DCC690B34382502A6B3FFD64F4779D75E57A0161D4FAAB0B8B137A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  CsExec.Service.exe
- Size 17KB
- SHA256 88773a254a7e056a83d6eb7d80b57cc0195cc16bca8317ea35a0576b6a38c639
- MD5 7734b6c01e0c7cecb74187e675259663
- SHA1 ab786ca77c67c97ad63444238187fab85f1c8716
- SHA512 210bf9442b44acf68fbd671cbee61bab49f6ebd191fb7d7518df8fc9d5affcee7cae69a91bee5e5a57a289a1d4e6417646de42e03fb1fabbce0cd23574632c2d
- SSDEEP 384:YsZOOW1SXLqF9Am3p0vA3Cth0VcSWLreLW/lAKmd+maym28W:ySXLqGmavA3CMn0mPmB
- TLSH
  T167823945AB90DAFEDCBA573D3CB347551B7DF7492212C39E2C8D481E1E933080AE26A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DattoRMM remote administration tool

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32