rurat | becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2

Analysis

max time kernel
59s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
database.msi
Size 28.8MB
Sample261002-g36yaass6p
SHA256 becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2
MD5 d1ae811c82f2ecc7d3ca7cb7fbbcd13b
SHA1 ff49a673aac7c53a31e5aec7c6ea3f6aac010b05
SHA512 6fc4bf61ca99f065853cbb9c9cb5b7dea67567874fe3e41fff538f66a926c1e38b70443602260d2b5d53c669e63752f115aa15469de111616689a4470db14fe9
SSDEEP 393216:zY8phN9mDlEYxIqwFsRkwSasMPqwwVSelRz75HcV9WvSmnl5fIAtqPsvXCY8ryyB:zRiEQIqwFJ1aoHjRl8HWvnsAtM
TLSH
T194672382F6804036DA67163256FADE38487DFC705F6123CF27D872396E728C15A3A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery rurat persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Loads dropped DLL 1 IoCs

pid	Process
2472	MsiExec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4016	msiexec.exe
7	4016	msiexec.exe
9	4016	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59458b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59458b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0007000000024439-103.dat	embeds_openssl

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4016	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4016	msiexec.exe
Token: SeSecurityPrivilege	3968	msiexec.exe
Token: SeCreateTokenPrivilege	4016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4016	msiexec.exe
Token: SeLockMemoryPrivilege	4016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4016	msiexec.exe
Token: SeMachineAccountPrivilege	4016	msiexec.exe
Token: SeTcbPrivilege	4016	msiexec.exe
Token: SeSecurityPrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeLoadDriverPrivilege	4016	msiexec.exe
Token: SeSystemProfilePrivilege	4016	msiexec.exe
Token: SeSystemtimePrivilege	4016	msiexec.exe
Token: SeProfSingleProcessPrivilege	4016	msiexec.exe
Token: SeIncBasePriorityPrivilege	4016	msiexec.exe
Token: SeCreatePagefilePrivilege	4016	msiexec.exe
Token: SeCreatePermanentPrivilege	4016	msiexec.exe
Token: SeBackupPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeShutdownPrivilege	4016	msiexec.exe
Token: SeDebugPrivilege	4016	msiexec.exe
Token: SeAuditPrivilege	4016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4016	msiexec.exe
Token: SeChangeNotifyPrivilege	4016	msiexec.exe
Token: SeRemoteShutdownPrivilege	4016	msiexec.exe
Token: SeUndockPrivilege	4016	msiexec.exe
Token: SeSyncAgentPrivilege	4016	msiexec.exe
Token: SeEnableDelegationPrivilege	4016	msiexec.exe
Token: SeManageVolumePrivilege	4016	msiexec.exe
Token: SeImpersonatePrivilege	4016	msiexec.exe
Token: SeCreateGlobalPrivilege	4016	msiexec.exe
Token: SeCreateTokenPrivilege	4016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4016	msiexec.exe
Token: SeLockMemoryPrivilege	4016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4016	msiexec.exe
Token: SeMachineAccountPrivilege	4016	msiexec.exe
Token: SeTcbPrivilege	4016	msiexec.exe
Token: SeSecurityPrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeLoadDriverPrivilege	4016	msiexec.exe
Token: SeSystemProfilePrivilege	4016	msiexec.exe
Token: SeSystemtimePrivilege	4016	msiexec.exe
Token: SeProfSingleProcessPrivilege	4016	msiexec.exe
Token: SeIncBasePriorityPrivilege	4016	msiexec.exe
Token: SeCreatePagefilePrivilege	4016	msiexec.exe
Token: SeCreatePermanentPrivilege	4016	msiexec.exe
Token: SeBackupPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeShutdownPrivilege	4016	msiexec.exe
Token: SeDebugPrivilege	4016	msiexec.exe
Token: SeAuditPrivilege	4016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4016	msiexec.exe
Token: SeChangeNotifyPrivilege	4016	msiexec.exe
Token: SeRemoteShutdownPrivilege	4016	msiexec.exe
Token: SeUndockPrivilege	4016	msiexec.exe
Token: SeSyncAgentPrivilege	4016	msiexec.exe
Token: SeEnableDelegationPrivilege	4016	msiexec.exe
Token: SeManageVolumePrivilege	4016	msiexec.exe
Token: SeImpersonatePrivilege	4016	msiexec.exe
Token: SeCreateGlobalPrivilege	4016	msiexec.exe
Token: SeCreateTokenPrivilege	4016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4016	msiexec.exe
Token: SeLockMemoryPrivilege	4016	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4016	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2472	3968	msiexec.exe	91
PID 3968 wrote to memory of 2716	3968	msiexec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\database.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 924C860045A12DD5A1B6760C12AF65A2 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2472
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\database.msi"
  2⤵
  PID:4660
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -config -instalrt
  2⤵
  PID:2856
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  PID:1632
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  PID:3132
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /printerinstall
  2⤵
  PID:4220
- - C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe" uninstall
    3⤵
    PID:1424
- - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe" uninstall
    3⤵
    PID:3548
- - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe" install
    3⤵
    PID:3212
- - C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe" install
    3⤵
    PID:3160
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  PID:4452
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /CONFIG /SETSECURITY
  2⤵
  PID:3092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4308

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
PID:1996

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1432

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3672

C:\Program Files (x86)\Common Files\Two Pilots\VPDAgent.exe
"C:\Program Files (x86)\Common Files\Two Pilots\VPDAgent.exe"
1⤵
PID:1852

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
PID:4968
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  PID:4636
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    PID:2500
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray -instalrt
  2⤵
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59458c.rbs

Path C:\Config.Msi\e59458c.rbs
Size 28KB
SHA256 f02eee2fa03a8ff7369840322c836995212ec9c79e7840a7b3b2598026f28c68
MD5 568db85cc392b05e059c58d665020868
SHA1 f0b59d355e415c8b534a8cfdb182879f25187e61
SHA512 bbfe700bb1dfb30ac760a7dd4f9871e4f1470fb8ceaecbb562be49787dc69589ab03f5e35da93c5ca9e82ed6b8a68706061bded862ad79ea160c23069c6d1dd6
SSDEEP 768:Hototot3mAkc3evhGHUM7RM01duECfA2Q5GBM:OPevcHUM7XduECfA/KM
TLSH
T131D25574A743CDC1E9005177BF4A4A4B2321661E638C0F23ABDD4D249EC5B7D7928E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvinst.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe
Size 55KB
SHA256 c9d87fe1a0df3c60117c1dd5cdbe949236ea3b3bb893ce62495cd0cde0627f5d
MD5 c8fe343301919e849e73e154a17a7397
SHA1 05c934206b104be4290666554adfbb0fe460dee1
SHA512 d01e7cad1b74ae56725df2145ad69d35639dbef9ffa02ded7b7ac772594ffdc16973280abb20c59299eee6b7832bc7b29dd75511a6e61aa99400b45ff2021dd4
SSDEEP 768:9qfYiEXOtlk4SgVg1pQtfVuTsxxSzELKoZbr2xo/2ENo:biEXYq2g1pC9uToxkiZv4s8
TLSH
T168435B0A7F418133E55144B96DF967E6047E65E08B7592E7B38C0A286870FD0EFB910F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp120.dll

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll
Size 640KB
SHA256 9ef6552edb9aafebd6755be99620baa6458a05bdeebcc39005d853c8fa26aa25
MD5 8ebb4bbf16a3c736518116fcb176cd66
SHA1 1b7d7fa1570c86becfdecaf6a1a2687686f33355
SHA512 c97c8432c440a920eb0933fbc82214743a3a3b843b8f04e105f4e7f15df6b4c2d93fc657bf996959048eb3458268ac74be049fa7b18abdc28b4b1d271392483e
SSDEEP 12288:72fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnPb:IuJzCaK9AB2EKZm+GWodEEwnz
TLSH
T1F0D44B13FB150AB0E192D3B891D74741D7F1BC898822E70752ABE23D5F67391AA2F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll
Size 936KB
SHA256 b2bbb16c35622ff8e788d144b916a5b6fd4df360e11bfa026ced8dd22340a69d
MD5 a8d72bee38534bb178b82b9e0b2fec1a
SHA1 ef27c488ccba78279106db6bcdb10f0ea20e2125
SHA512 06c3a4f8b5bd88a976ed67be1a7a3b81d6ba1529ccac908aae3fa0f61efb39ff2a72f5907712b104bd25d86791f88a6f33d713ed4ea7b6bc7c03156f345c3570
SSDEEP 24576:2kZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPc:2kMAlM8ixQI5C6wm
TLSH
T17715AE4672A106FAD563D2B4C9A75607E2B2B85B1630D7AF02E0866D3F23B30965F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupdpm.dll

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll
Size 38KB
SHA256 fc7a6daa09e3545c24039b44f481c8517c50fe1186fa3cb2b14c8f67d1c1b473
MD5 c158e2dcfac85ed1c84fb8b2d3aaaa11
SHA1 380caa60f3f8292919787490bc41ba5d59c21b6f
SHA512 ed52a093bd8691f00f7b375f4acf68e81b2a9f471ca4f59144fae4af0bcb861e9f204b579c2098eed3286c94e7eef1b6aeff939ceeffd9e5f148c576368cfa45
SSDEEP 768:uek2AuDHuROuyVrGWngM328PAh8bWgs5fLutFr2xi42ENm0:moebh8bRs5zutR49i0
TLSH
T1BF035B7AA7381447D9A3D97CE1E65E17EAB076422B6086EF0331861D0F237E19B38317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupdrv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
Size 103KB
SHA256 bfa7f6e39561796428ef22dfb0a16bd095089836d1c44b7d6aa3c68dfa1ed0d3
MD5 faf24658b37c49c0c51afbad59612683
SHA1 0cfa5220bb7443acab063887c945ed73d93b1998
SHA512 77f282b9be41fd89a68a43aaca3b3f9ffbe2b5e5b93a28d80d73414490a239afcb8c8a7782bec6e6544a3f45f0e1d3f737193c3a4643e630641b78eff3b5a339
SSDEEP 1536:BFqz35CEMCZFwsbn60NhoBGO9otLJx39aHXI0OYWuszA4l9zgg:HwJ3MGimnrhoAOkNa3I0OYWtzAEF
TLSH
T14CA329193B5803A5F53185BACBE6C61BD77670440BB05BEF52A1CA1E0F32EE25D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 9.4MB
SHA256 299b3f5e49d3303e0a4793fee52a1165c340a560729115f1a4d421d6f0416fa5
MD5 5e5d28b2f2bbe4e7cab4e618795e5d2e
SHA1 1518a1ef3060da0b8b37ad3369efc51f65cf93d9
SHA512 7cebf0b9fe348606d3b8cd486a8cd0f9a49111b61a0b84039eb86c7a8fa8782edee87b90d2cd61127e7729b1eff1c096f1d2728e3555031be4d2302ad7d8951d
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/gqc2d:ImyhTWMWHc2EeJUO9WLQDh
TLSH
T1F7A62955EA8B28F5EE936771818BF33F5734AE00C636EFB7FA08D525A8336821905351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 15.6MB
SHA256 7906a81b1dec372b4c232306678fda0cbc46db41e3db0c06b858d54d60cd7ab6
MD5 7b278a04998a55c694f3c559c93ea6d6
SHA1 574b1bd5d0499e4621f9ed5d1c6b8c58d9081c4a
SHA512 0f37327fe81971e147e15661e766728f6b4a60f66f1da6ca9772bb37a84c61f5109a75cb6c33e866b24b08d6f71a00b2443f9bbeb3fe8dd81ce65b8b4e083171
SSDEEP 196608:wSGMXyBKNfobRTbAyeAjfVhZZ0FjbrR5za:wrMXyKJobRTb3njd3SF3rTa
TLSH
T1E7F66D237285953AD0AB0B3A9937A754993F7E612E128C0767F83D4C7F356C02D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 21.4MB
SHA256 d8e6765d0dbfbdf436f88c7cac85476b41edd6ded12f24bb34fe3932737ba613
MD5 ddd4b884ebbfb34cfbde936159e3489e
SHA1 1feb04f1d48a70b79f70dc94daf62a10ec99648d
SHA512 05bfced1692b62a80cea55f03b6af5f4b75e5a97ba0a5b155384a26b5a9f67c8f400462faeb29a57b263f489ba65820fbde1f22aaae8614a3a4d13da12ec3d2c
SSDEEP 196608:RRL+UuGdwiu02guteFpDdOmcnojKqdXL5cB55/Jl9jsHCRe2X4:HLpuGpTitS5jjVu35/XZgCI2I
TLSH
T1B8378E03B385943AE16B1A3A5D37DA549E3F7E602A169C0B2BFC394C1F355803E2B657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 1KB
SHA256 1c9c5f69acdcab50541ff79178bdaf483b984bee8daec75d18dadc10c3157837
MD5 ce55b915e76a708f82e51dd92c3389d8
SHA1 f9b9de41c1a9b9526250cb8dd036fcf9235befbf
SHA512 f3097d7dac1c75aa97d72b92b5adf5bc51b6a9498958b26d1806f03c91fdf0a5124905b07fdf0c6ef2a64c35746c43b148d896246f1fe69893b302042d3b3278
TLSH
T11E31B6699E7831839E50EDE41DE6F133ACF4B350A9DA7101A771450620D02732F49D8E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_65802118A1B42BB7E866C4DD04A00F68

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_65802118A1B42BB7E866C4DD04A00F68
Size 1KB
SHA256 7405f439191eb3b0428b9029d5074c59fb4c8ae08439aa4493cdc1e5fa27f520
MD5 8e7be8b9066efe9df35a2cf27df8a67c
SHA1 bbd450e8ef8b83d194540d3d80927238f2ba2e9b
SHA512 501aa3a6a72f51a0487e5c17fb71c681f69e5f5de0018a8638e645c295738500f3114f126e9d452db78d04b77702c9d8b4120618c60a56028eac5903cec86a84
TLSH
T1A931FA1FCD6EF601FB45D61609D18E77A8F076AC82ED5D2935B315CB28507624D03001
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 532B
SHA256 d84b3457e7c4cd8660c668a08f3eab0119677490435a5390efb7e7c8f02b102f
MD5 044d8d66d05a59d58994ed3260e0bab1
SHA1 4cd4e30f4f12654c06e2b8961cc072e004d5f8d8
SHA512 d89bd9ca3eb24b4dc542bca6852d8430bcaf2b74e888733408498646501b7b9a96f55fcd101045f6303131fb207e9643c9b5b22454e906ed5b59875703214ed0
TLSH
T10DF0DC0416F9033EF0B6CF7D4ED468D19925FD123C56427A1B96571C9A29D10CC1753E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_65802118A1B42BB7E866C4DD04A00F68

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_65802118A1B42BB7E866C4DD04A00F68
Size 540B
SHA256 7339d1be74c3c786df7a661e15c9a8511e54a8f4496e7f9532d458988d35e849
MD5 2eb3542dd40d391a0538f68fdaa60258
SHA1 5abb5d43c5d7df848057abd2645cfb1ff10c32dc
SHA512 5eb0eb8a199b1b7c146057cd2a2364341cfb71cffeddbbad851001b872a6abf7fc11b3e969cf1ddea4c83ee0c438ab516ea1349526e007add1bcbd9e58d44530
TLSH
T171F0971C18FA421EF430DA7842D776E38931F9032C059A680FD1870D6A23F01BC21B36
MD5 SHA1 SHA512 TLSH

Submit Download

MSI66C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI66C4.tmp
Size 649KB
SHA256 085eacfc60a533c33950ac55f17a3afa5b7baf6e5ba73ec112adf5ed88177175
MD5 9130f41097ee2c54f979bf580706d62c
SHA1 8a31f3e18563adfef88bf9c540dc6cb7bb53ad14
SHA512 ee2f5e3ff3dbcf5dde420398193c1951a56dd8f85b8eb6c0682b89e0744e59bd56d38de9f183d93bfeb5b952e5c0116adb657cbef93e0852a05af5fa1c1088f3
SSDEEP 12288:pvEQx02n8dTBNzQGy5w8Z0IrQ9Eht74mUJEUAuh4Mqvggj+OC:pvEQiTdD2FMmUuUsYc2
TLSH
T11DE48C227A84C071E67F24326838D2715ABD78311F729BCB1798097E5F744C1AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59458d.msi

Path C:\Windows\Installer\e59458d.msi
Size 28.8MB
SHA256 becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2
MD5 d1ae811c82f2ecc7d3ca7cb7fbbcd13b
SHA1 ff49a673aac7c53a31e5aec7c6ea3f6aac010b05
SHA512 6fc4bf61ca99f065853cbb9c9cb5b7dea67567874fe3e41fff538f66a926c1e38b70443602260d2b5d53c669e63752f115aa15469de111616689a4470db14fe9
SSDEEP 393216:zY8phN9mDlEYxIqwFsRkwSasMPqwwVSelRz75HcV9WvSmnl5fIAtqPsvXCY8ryyB:zRiEQIqwFJ1aoHjRl8HWvnsAtM
TLSH
T194672382F6804036DA67163256FADE38487DFC705F6123CF27D872396E728C15A3A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupd.gpd

Path C:\Windows\System32\spool\drivers\x64\3\New\rupd.gpd
Size 17KB
SHA256 ee1e4d9869188cc3fa518c445ecf071845e5bd8be56767a9f7f7dd3ace294ba5
MD5 8ee7fd65170ed9bd408e0c821171b62a
SHA1 9d14a87a049c3b576cec4b28210f0c95b94e08e0
SHA512 5740ab3545d2217ba2156c58ba9af6681d73116ab5dfbeaa5ab615d9cd0c77716c25865e67188e9d7892b340776755d4cbb1a3e98faeaf8b6bb4b2cca00d8ae6
SSDEEP 384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
TLSH
T1DA72AC2C39D64ECE217FAF36527B2AF1F6A51BA79092982638ADB5344F3C0159144E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupd.ini

Path C:\Windows\System32\spool\drivers\x64\3\New\rupd.ini
Size 41B
SHA256 7ba0ace1e899c38cb5e8bf303868c0ab4b9890d536009cf21c958b114888dfa3
MD5 610dfcd7ff61b76daac9ddc3cdaa64a9
SHA1 343a63a7e2b0617f30b94e15e236df7892fe722d
SHA512 d8095398acc9de610e42eab655145bbacb09ae2d460906f9b490e48947ea802795c00cbfa3c674cdcc344d8a64fd63961d2d4a8999e0f0badafd3e367fe8b495
MD5 SHA1 SHA512

Submit Download

unidrv_rupd.hlp

Path C:\Windows\System32\spool\drivers\x64\3\New\unidrv_rupd.hlp
Size 20KB
SHA256 0c02b226be4e7397f8c98799e58b0a512515e462ccdaac04edc10e3e1091c011
MD5 6798f64959c913673bd66cd4e47f4a65
SHA1 c50faa64c8267ac7106401e69da5c15fc3f2034c
SHA512 8d208306b6d0f892a2f16f8070a89d8edb968589896cb70cf46f43bf4befb7c4ca6a278c35fe8a2685cc784505efb77c32b0aabf80d13bcc0d10a39ae8afb55a
SSDEEP 192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
TLSH
T17692846A388DC846EB44C27DCAF17BE94D295C718EF09687F9897B0CA830E15E299458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupdui.dll

Path C:\Windows\System32\spool\drivers\x64\3\rupdui.dll
Size 203KB
SHA256 1dec445cb8060808ff92de3c18c88b57a120bdc2299c08005b8571cf184830fd
MD5 8d67e9fbf687f63ffe1559dd9ca4ccbc
SHA1 6257f9cd3daa696849dbb13d9117711d0b332734
SHA512 9a45300bd73a767023c3b65d1bb5ccb24615d17aa114db3d1203d8e60fd52f5906a4add719c5f2d2f3c6a30f70177fd0b2296a12c8600fc1a9668f5efa404d60
SSDEEP 3072:LZN5YrUYkIih2FJ5tmN8DNWcpQOw9Tsk1n1WOA6uBgmQk:LZNhfxh2FTpWO2T/1WOA6uyk
TLSH
T1E214190B77544266C1B28238D9A74617F33378145B368B9F0662A72EDF33F51AD3A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrv_rupd.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrv_rupd.dll
Size 479KB
SHA256 3e85b67ce36ae99a2ffbe3d3c1f37c8ad28aa4dbcc68b643e278672cfc609447
MD5 3168484be1cee5d0cdff1dfad2026aa9
SHA1 18fd050b45732a73a6b176f8229d710f5cf472a7
SHA512 32d6f9edcdbfbd57798e3a1480e0ba6db40ecc5b3fbd8eb019af65f3f4518a58c9b3439e5f02416dac1499a23bbbd4848ce7519987a820758b5b4311ed8fbdeb
SSDEEP 6144:egjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvQy:eglSTPaRxFdLXyJ/ebEEkx0rqJduR
TLSH
T10BA45A4AF76104F5C49BC074C666DB37EFB5B4B910049B474BA2DF722B23BA05A1B326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrvui_rupd.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrvui_rupd.dll
Size 875KB
SHA256 ce231cc8d87605a1139570d9e91ec92bc713feb587d93df096f37ddebd5667dd
MD5 6185b642327b1f9f326c6611f3af379c
SHA1 1eeae6aec98a942e2870385cd6fb9ad6b8a7571c
SHA512 83467bca8f397d42ae82741b39c56d04f96b39aba880e9d60fac781294bc3c600d6ba7a6af79f46167dcf5ac1340b0c2a25c54d02474c45ef37787ade38c5d36
SSDEEP 12288:fpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so+:vZ5F/bYogxJUB9cwtHFMDF
TLSH
T1A8150901A3FA0169F1F3CB7499B58256DE76BCA56B35C6CF0290425E1A32BE0DA35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupd.lng

Path C:\Windows\system32\spool\DRIVERS\x64\rupd.lng
Size 96KB
SHA256 c8df350f95ffeeed30060092dc8666eadce040a4ddcb98e7a9293f87d19387a8
MD5 1614e6cdf119fd284d476f7e6723b3ad
SHA1 3ff9164c9e5fc47169cc1c6eeca22aab099f2ea3
SHA512 8fbcb156b2f9637bc15fa71758a361cb2500f5a19875ee6be2b52fc3171c38353a6cdc623e36777d052e0b319c7af934d2d1dbe92e69666c9b9ad749610ba471
SSDEEP 768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
TLSH
T1E1A3FF1B66EB0116B2F7E650EAB602729B77785D263C8B4D20C11A8C3BE1D4069537FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdnames_vpd.gpd

Path C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd
Size 14KB
SHA256 2835a439c6ae22074bc3372491cb71e6c2b72d0c87ae3eee6065c6caadf1e5c8
MD5 7162d8977515a446d2c1e139da59ded5
SHA1 952f696c463b8410b1fa93a3b2b6dae416a81867
SHA512 508f7ca3d4bc298534ab058f182755851051684f8d53306011f03875804c95e427428bd425dd13633eec79748bb64e78aad43e75b70cc5a3f0f4e6696dbb6d8e
SSDEEP 192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
TLSH
T15252F9A014F0ED5B1A7AC316BC6D8786A269814F03E2E52C735E59760FFF96295E203C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unires_vpd.dll

Path C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll
Size 756KB
SHA256 b00f8da36932036a6008b3ca92691ad4b347f0df3659dfe1c9d2d09258dc39db
MD5 9f4d24cc5d0b86d8831b4d0dddca2df7
SHA1 843b5ae8d477dadea9dbbac76e8d14c7a30da765
SHA512 c53cec7bc4d4aa0bde4e3a222c4398470199bed65e16c55c1b6c0e0aa0aa3884c9cb8533cd95d3addd7fd0973c74258982586675d2ccf0ee7900043983438bfa
SSDEEP 12288:AkozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLH:IzBEGbL4Np84TQazCSiRH
TLSH
T1D5F45C2A76FD6E06F6B32A7528F1095735FABC48437CD72D2280B75C985E7542820FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 1fb6f662361d800bde012cd19b1ee7dfa5c50d394ffb33e8b6480d2f3240a7e3
MD5 054950b214395e19b8222074c2a18e40
SHA1 a774bd891f7cfd970870c9c8da6d1615aa93d147
SHA512 e856fcadfb71c18c1d1e8ff8c20b770f820cd7a0012e68f656cd36cccf319aafe7befeb61450a5ce7915b47d982733c7fc1a00046db12b90e647fc917c6a8912
SSDEEP 24576:gu8m+1zgdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:H
TLSH
T17647902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{33102f9d-dddc-4b4d-a676-3fc92d1943e9}_OnDiskSnapshotProp

Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{33102f9d-dddc-4b4d-a676-3fc92d1943e9}_OnDiskSnapshotProp
Size 6KB
SHA256 57ef613bd8d9b0b8723c93bf6a46669658d1799c08ac212b9682a6d3f545e568
MD5 6ab0bb9fbbb2bc5876b0f887519e9f18
SHA1 32df77484edeed99249ce96492b043f50e066e01
SHA512 41aec4a41a6a7aae8296f853ed05d757581c2f1aa1dfa1b6fa18ef6e2fa49741438a9eafba91e5ac203f1a01740ce5aa6f7112cbd3f46b24fcea20d33dc5da6d
SSDEEP 96:FAxO46o0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:+xJub++ZVmN
TLSH
T146D177085AE54311E2F3AB7229F14557A877B911EF33CB8E0198238E6660A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1632-122-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/1632-123-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/1996-132-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/1996-131-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/2500-347-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2500-346-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/2856-114-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2856-113-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/3092-338-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3092-337-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/3132-128-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3132-127-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/3152-375-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/3152-355-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3152-368-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/3152-361-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/3152-354-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/4220-318-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4220-317-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4220-136-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4220-137-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4452-322-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4452-321-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4636-352-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/4636-353-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4660-107-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4660-106-0x0000000000E10000-0x0000000001E4E000-memory.dmp

Download

memory/4968-351-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4968-350-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4968-357-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4968-364-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

memory/4968-371-0x0000000000FE0000-0x000000000261C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads