Overview

overview

10

Static

static

3

2026-09-24...ry.exe

windows10-2004-x64

10

2026-09-24...ry.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry
  • Size 3.3MB
  • Sample260925-tgctjavyax
  • SHA256 1b4d5eadf3e12c8b01e196682b7a77063d22508a95e74c9d90f5cbffe2909b1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
rmsdefense_evasiondiscoveryexecutionrattrojanupx

Malware Config

Targets

    • Target
      2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry
    • Size 3.3MB
    • SHA256 1b4d5eadf3e12c8b01e196682b7a77063d22508a95e74c9d90f5cbffe2909b1e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionrmsrattrojanupx

    • Family: RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms
    • Custom signature

      UPX dump on OEP (original entry point)

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Stops running service(s)

      defense_evasionexecution

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks