rms | 62a4376c9e4bbde3377fe638444b78b42b27c60212516913bc0434b2b2c081ee

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewerQS.exe
Size 17.1MB
Sample260911-15cxrsfb86
SHA256 62a4376c9e4bbde3377fe638444b78b42b27c60212516913bc0434b2b2c081ee
MD5 1301601dc424c529e82fcaa6d637c6e7
SHA1 44c142b0498d6d234ca53bcca492860383ae5271
SHA512 dc89ba26112e60095aaaab3485fd8a15bd9f627c28a8fc0db0beed55b71328dc0426fd3ea050f4886e8bfe0d4007a65a4814b53a15332d71d2e9473ac1de99da
SSDEEP 196608:f4RGcvEyPFoZBw01myIgQot9fHKgupCALDVIXJF08OyIqhfr4/nbBrIlcmw2/LzQ:f4wcF0MgZHeOJjO4f+nbBrww/RFl99
TLSH
T16A073317FBE10616D8B747BE09BE0B1417B6BC981A13A78D0394B129AC777818CB53DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery rms persistence rat spyware trojan upx

Malware Config

Signatures

Family: RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AgentRunOnce = "C:\\Users\\Admin\\AppData\\Roaming\\Remote Utilities Agent\\70170\\6607284D64\\rutserv.exe"	rutserv.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584	rutserv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1840-0-0x0000000000400000-0x0000000002975000-memory.dmp	upx
behavioral2/memory/1840-79-0x0000000000400000-0x0000000002975000-memory.dmp	upx

Executes dropped EXE 5 IoCs

pid	Process
940	rfusclient.exe
4160	rutserv.exe
6096	rutserv.exe
3008	rfusclient.exe
2668	rutserv.exe

Loads dropped DLL 6 IoCs

pid	Process
4160	rutserv.exe
4160	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewerQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 6b000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c000000010000000400000080010000190000000100000010000000b009e99a5cfc928a173190106dbb32a92000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	rutserv.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
940	rfusclient.exe
940	rfusclient.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
3008	rfusclient.exe
3008	rfusclient.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	rutserv.exe
Token: SeTakeOwnershipPrivilege	6096	rutserv.exe
Token: SeTcbPrivilege	6096	rutserv.exe
Token: SeTcbPrivilege	6096	rutserv.exe
Token: SeDebugPrivilege	2668	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3008	rfusclient.exe
3008	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3008	rfusclient.exe
3008	rfusclient.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
4160	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
6096	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe
2668	rutserv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 940	1840	TeamViewerQS.exe	86
PID 940 wrote to memory of 4160	940	rfusclient.exe	87
PID 6096 wrote to memory of 3008	6096	rutserv.exe	90

C:\Users\Admin\AppData\Local\Temp\TeamViewerQS.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewerQS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rfusclient.exe" -run_agent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe" -run_agent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4160
  - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe" -run_agent -second
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rfusclient.exe" /tray /user
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3008

C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe
"C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EULA.rtf

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\EULA.rtf
Size 15KB
SHA256 879180116b82210292648709982f405eae84b05e6f2ff324a6a5cc7cd512d3e7
MD5 9b0e600eb09e7a86199f7ba245d1cd2b
SHA1 e3e52b3e04b08e59aae74300f7d30c3d0aa27148
SHA512 dd1622474c48ecf5c95e7585fb30b5279cf45dfc89332531758838b05f73499f536f7cadaf529aa4fa5ae0808e30a455465829db7d13f2ee2e7d9b7bd12e17e5
SSDEEP 384:Akc9TI9T+FCnjK71n5yqmOxSCH/Cu37gFpBukSVb5R:AkcuoCnjK7Rh5Cu3U/W
TLSH
T15C72EBBBF309177313C20362370E9DE6F32A4668B37E51A2246C415D2376D58E3BA5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

branding.ini

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\branding.ini
Size 674B
SHA256 dedb9c33b36b950dcd2e4492301e48491136e95e19d058b8458752f019befd0a
MD5 54e5a8d26aaad70d18f61bf532129d8b
SHA1 a81a63d06570dcea8820dc5e028ac0b18c31d151
SHA512 090b50bb609712e89298bc96c74f0f0a708475e8554b855440dca3e0837888ecb75a9310be9fbe3ca73829293c6021f67ea9f7a5fc552c0a840b36e596be1e02
TLSH
T15001AF1167F50128F5F377455EF592B44B617DE1A838C49D02C4014F05F0982AB22377
MD5 SHA1 SHA512 TLSH

Submit Download

eventmsg.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\eventmsg.dll
Size 51KB
SHA256 ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745
MD5 ca8a4346b37cdd0220792885c5937b30
SHA1 eef05f4b7fb5f8aabfb93d10a6451cc77b489864
SHA512 c286b0fa9d24a85fe63d3a3d801f135d12409736742c4fc16ba1dc15529df136577dc8975736146437dd56467576fdedb4ac50cf05ab054547504f3dc5ca0c35
SSDEEP 768:tsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYdhXdsn:tza/pu/TKJ/OMpTryYvan
TLSH
T1E9336DF7EB40C436C4160AF338B55195AA3B3E601D21BEAB53F89458CFDA3816D2E15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\libeay32.dll
Size 1.3MB
SHA256 7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95
MD5 d9871a6ba02aacf3d51e6c168d9c6066
SHA1 42012a0116a9e8aed16c7298bd43cb1206a0f0cd
SHA512 ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f
SSDEEP 24576:SNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1j:ilUfzN4jH3PlyjYpOLqd/kP1j
TLSH
T17D55AD03A792CDB2E58981BE51B7977F5A37A6114329C6C38BA02D51DD221F2633F3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\logo.png
Size 11KB
SHA256 900f787d7bcc774df9df32d65a04494faa6e30c9647d81657c946f3e19f4ecdf
MD5 8c65c32c734d988de2d3d690e9a208fa
SHA1 c12426d7a7d3387565c894224819c70b5991d3cc
SHA512 000dee71d9c9b0e721a6a9f6a19e32dcc4b0c2ce5b4d6479a1ae36d4194319092573befe6b28552d9b5279430322e71582e9e2edcabde715e389b1860c1645a0
SSDEEP 192:BdkQq//TE61Gpjx26P/MhlT5awAQNNQGhSD0/1R6BJJP2GQx1ikA:BTmg8M/ML5aw3Cw/1qJZv
TLSH
T14B32C05CBA0568CA51728E83038B9112DF7E4740C96F7273392A6D43095B7BB252F9F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rfusclient.exe
Size 10.4MB
SHA256 02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40
MD5 68a63168426f28bc06c7c06eac6f09d5
SHA1 ae947e6b9b3322f7837396f606e64b0f372fa78c
SHA512 7beabe39242237dd19606392bb7970f2eea0e8d467ee42a10e8ad3608e9b6a6aa060e4cd112fce425677dcc33ea062c6224574599351e81060c348409eeb11a6
SSDEEP 98304:xF4qNDh+XGXrCXK+SEWl0Z784jXGHrRK4TFktr3q17f+d96OV8ouJxadU0MZt:xiqWAEWk84jGRK45kx3XTjONaI
TLSH
T1CDB69E13B288643AD46B0A7A4837A7645A3F7A252A15DC5F6BF4094C4F37B807E3E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\rutserv.exe
Size 19.8MB
SHA256 f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5
MD5 31c0bafc3f6e6c7322a7a32ac1bd87da
SHA1 42fd1a41e1eef5998de674ec068c702f1ee3b4f3
SHA512 ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab
SSDEEP 196608:QEY5GwRkSKyuh6XVocAbyeEA183ZaOp6lAFywgK1HD3hHi9J:QEY5GwqMrWEAG6lA0lK1HD3JI
TLSH
T1F1277D13B644A43AD09B1A3A5D3BDA546D3FBE612E168D1B2BF83D8C1F356803D3A147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\settings.dat
Size 11KB
SHA256 a8d067b78f441cbf8df09936a7a0ac47599c0b59b8aad24b9fc439c3988d294e
MD5 436842b2c300a480170b4afcb6df10fa
SHA1 f40219f7cbcb45f9084e43beb13f0741ab1d4454
SHA512 2f7d2cec47c76502dc6849768c99e4f810e6ebe93a2a9bf6062ec8c3f6c4ef1816c702b10d34c12006a46324c0771c78e9a78a6ae1efe2ae5d5b504b29a8bb07
SSDEEP 192:G88jIl9mfb/jext7UvB8byxDMRcknD2pHpeGfO0AcJJ0w+5V:hOexm8byzknD2pHpeMk5V
TLSH
T1E8324B3389023D329A65A82044A53A5CFDA962EF7305E1ABFE4C1DE406065FF7417E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\ssleay32.dll
Size 337KB
SHA256 af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0
MD5 fe6d8feaeae983513e0a9a223604041b
SHA1 efa54892735d331a24b707068040e5a697455cee
SHA512 a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d
SSDEEP 6144:16MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1Piw:16MNzVgz1LgXCpfoaDqHojjYkARqPL06
TLSH
T17B746C53F79180B2D4825675647B6FBA3E3E6701436AC9C3EB601D6C4E103D49A3E3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\vp8decoder.dll
Size 380KB
SHA256 36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7
MD5 41acd8b6d9d80a61f2f686850e3d676a
SHA1 38428a08915cf72dd2eca25b3d87613d9aa027dd
SHA512 d174638965ec781cbcb2927ceafb295c3176dc78da8938467faca3e512a42fe71a9dc1070f23e1c95f0b7c157fff3b00a8b572c39e4670713564f1310360ed23
SSDEEP 6144:lIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcS:lI8tiDOzyH9H8Tu6h04fZMZoMPuvfC
TLSH
T123846C11A6828131D8FE15B8ACBCEE95222CFE0D9F748DDBD38C294959B21D15634FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\vp8encoder.dll
Size 1.6MB
SHA256 0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa
MD5 2ac39d6990170ca37a735f2f15f970e8
SHA1 8148a9cdc6b3fe6492281ebad79636433a6064ab
SHA512 7e30fde909d5f8efd6c2e40e125525697267273163ac35cf53561a2bd32e5dad8e4fba32905f53e422c9c73b8ad9a0c151f8d36042c5f156b50bf42dc21a9cee
SSDEEP 49152:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwz:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
TLSH
T1C2756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\webmmux.dll
Size 260KB
SHA256 bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d
MD5 8a683f90a78778fba037565588a6f752
SHA1 011939c1fa7b73272db340c32386a13e140adc6a
SHA512 9280fbb121f8b94f57560d1be3bcfe5e7c308d54dac278f13ea6c00256444fb9f17f543dd0d32c9844460818c1a50d83b26ce51c79698e9ca7a304652a3f5ea9
SSDEEP 3072:xW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTY:xWSfr7sXSmPDbKPJ6/AsNk+S
TLSH
T1B5448D013685C075E9EF02719878AB2918FDBD724B64C6CBE7881D4E1E316C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\webmvorbisdecoder.dll
Size 365KB
SHA256 f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e
MD5 c9d412c1d30abb9d61151a10371f4140
SHA1 87120faa6b859f5e23f7344f9547b2fc228af15b
SHA512 1c020afa89cdae55f4dcb80a455dc1b352f40455142f3947ed29c3e3d51fbd465b6e0ea16cd103186c252783a3f2a7f7c417e4df5727d9b2db511b650308face
SSDEEP 6144:RaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtL:loPH0GgEp0gVd1ValsQXsHL
TLSH
T191847B01B992C57ED4EE017018AC7A4BD97A3A6D07B8CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\6607284D64\webmvorbisencoder.dll
Size 860KB
SHA256 83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1
MD5 a59f69797c42324540e26c7c7998c18c
SHA1 7f7bc5bc62a8744f87a7d2e30cc6dd74c72e19b4
SHA512 837f244e6b70658974506ac35bd3ee2d413b89fe4b26e75f4a61cc7bec63e999c9c2cffb690ad567f74962bab13f2f5471300cd0e0cfe61bb1084072cb55c38b
SSDEEP 12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN1:YYF+Eyx2lzujtEIYRc1cQmsGa7ON1
TLSH
T18415B213F9929D67D7E802310091F5355622BCBCC3A35AF73F8476FD39A6A805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-84-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/940-86-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/940-81-0x00000000006A3000-0x00000000006A4000-memory.dmp

Download

memory/940-90-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/940-82-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/940-83-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/940-88-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/1840-1-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/1840-0-0x0000000000400000-0x0000000002975000-memory.dmp

Download

memory/1840-79-0x0000000000400000-0x0000000002975000-memory.dmp

Download

memory/2668-126-0x0000000000400000-0x0000000001896000-memory.dmp

Download

memory/3008-125-0x0000000000400000-0x0000000000F17000-memory.dmp

Download

memory/4160-98-0x0000000000400000-0x0000000001896000-memory.dmp

Download

memory/6096-106-0x0000000000400000-0x0000000001896000-memory.dmp

Download

memory/6096-124-0x0000000000400000-0x0000000001896000-memory.dmp

Download