rurat | becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2

Analysis

max time kernel
62s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
database.msi
Size 28.8MB
Sample261002-g36yaass6p
SHA256 becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2
MD5 d1ae811c82f2ecc7d3ca7cb7fbbcd13b
SHA1 ff49a673aac7c53a31e5aec7c6ea3f6aac010b05
SHA512 6fc4bf61ca99f065853cbb9c9cb5b7dea67567874fe3e41fff538f66a926c1e38b70443602260d2b5d53c669e63752f115aa15469de111616689a4470db14fe9
SSDEEP 393216:zY8phN9mDlEYxIqwFsRkwSasMPqwwVSelRz75HcV9WvSmnl5fIAtqPsvXCY8ryyB:zRiEQIqwFJ1aoHjRl8HWvnsAtM
TLSH
T194672382F6804036DA67163256FADE38487DFC705F6123CF27D872396E728C15A3A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery rurat persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Loads dropped DLL 1 IoCs

pid	Process
2232	MsiExec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c487-83.dat	embeds_openssl

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3260	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3260	msiexec.exe
Token: SeSecurityPrivilege	2208	msiexec.exe
Token: SeCreateTokenPrivilege	3260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3260	msiexec.exe
Token: SeLockMemoryPrivilege	3260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3260	msiexec.exe
Token: SeMachineAccountPrivilege	3260	msiexec.exe
Token: SeTcbPrivilege	3260	msiexec.exe
Token: SeSecurityPrivilege	3260	msiexec.exe
Token: SeTakeOwnershipPrivilege	3260	msiexec.exe
Token: SeLoadDriverPrivilege	3260	msiexec.exe
Token: SeSystemProfilePrivilege	3260	msiexec.exe
Token: SeSystemtimePrivilege	3260	msiexec.exe
Token: SeProfSingleProcessPrivilege	3260	msiexec.exe
Token: SeIncBasePriorityPrivilege	3260	msiexec.exe
Token: SeCreatePagefilePrivilege	3260	msiexec.exe
Token: SeCreatePermanentPrivilege	3260	msiexec.exe
Token: SeBackupPrivilege	3260	msiexec.exe
Token: SeRestorePrivilege	3260	msiexec.exe
Token: SeShutdownPrivilege	3260	msiexec.exe
Token: SeDebugPrivilege	3260	msiexec.exe
Token: SeAuditPrivilege	3260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3260	msiexec.exe
Token: SeChangeNotifyPrivilege	3260	msiexec.exe
Token: SeRemoteShutdownPrivilege	3260	msiexec.exe
Token: SeUndockPrivilege	3260	msiexec.exe
Token: SeSyncAgentPrivilege	3260	msiexec.exe
Token: SeEnableDelegationPrivilege	3260	msiexec.exe
Token: SeManageVolumePrivilege	3260	msiexec.exe
Token: SeImpersonatePrivilege	3260	msiexec.exe
Token: SeCreateGlobalPrivilege	3260	msiexec.exe
Token: SeCreateTokenPrivilege	3260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3260	msiexec.exe
Token: SeLockMemoryPrivilege	3260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3260	msiexec.exe
Token: SeMachineAccountPrivilege	3260	msiexec.exe
Token: SeTcbPrivilege	3260	msiexec.exe
Token: SeSecurityPrivilege	3260	msiexec.exe
Token: SeTakeOwnershipPrivilege	3260	msiexec.exe
Token: SeLoadDriverPrivilege	3260	msiexec.exe
Token: SeSystemProfilePrivilege	3260	msiexec.exe
Token: SeSystemtimePrivilege	3260	msiexec.exe
Token: SeProfSingleProcessPrivilege	3260	msiexec.exe
Token: SeIncBasePriorityPrivilege	3260	msiexec.exe
Token: SeCreatePagefilePrivilege	3260	msiexec.exe
Token: SeCreatePermanentPrivilege	3260	msiexec.exe
Token: SeBackupPrivilege	3260	msiexec.exe
Token: SeRestorePrivilege	3260	msiexec.exe
Token: SeShutdownPrivilege	3260	msiexec.exe
Token: SeDebugPrivilege	3260	msiexec.exe
Token: SeAuditPrivilege	3260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3260	msiexec.exe
Token: SeChangeNotifyPrivilege	3260	msiexec.exe
Token: SeRemoteShutdownPrivilege	3260	msiexec.exe
Token: SeUndockPrivilege	3260	msiexec.exe
Token: SeSyncAgentPrivilege	3260	msiexec.exe
Token: SeEnableDelegationPrivilege	3260	msiexec.exe
Token: SeManageVolumePrivilege	3260	msiexec.exe
Token: SeImpersonatePrivilege	3260	msiexec.exe
Token: SeCreateGlobalPrivilege	3260	msiexec.exe
Token: SeCreateTokenPrivilege	3260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3260	msiexec.exe
Token: SeLockMemoryPrivilege	3260	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3260	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3260	msiexec.exe
2208	msiexec.exe
2232	MsiExec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2232	2208	msiexec.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\database.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C831981F671B02661CE53F1258DDD1A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\database.msi"
  2⤵
  PID:1960
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -config -instalrt
  2⤵
  PID:5240
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  PID:3816
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  PID:3220
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /CONFIG /SETSECURITY
  2⤵
  PID:3324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3312

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aad59.rbs

Path C:\Config.Msi\e5aad59.rbs
Size 28KB
SHA256 5df6819f296eed915f7853b646c1677f931a5410cb182f6e57e32b687f8dc19f
MD5 25f106233f17a0bf2bb962eb7ba93527
SHA1 5e8b0f47ecf262890f3c2cd0d3149ce4cd932770
SHA512 e62ae8c4f6eb4d18b1ebd5f2c383a9a8148f3bff2295e38f7d82c5d5c38f72cb25e9da11225642ccd0f0df988d51720e8fac2df9a7cbdf5214c13cbe92baaa35
SSDEEP 768:yototot3mAkc3evhGHUM7RM01duECfAqCz2Q5GBf:1PevcHUM7XduECfAqCz/Kf
TLSH
T152D25574A743CDC2E9005177BF4A4A4B2321661E638C0F27AB9C4D249EC5B7D792CE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 6.7MB
SHA256 ee2aea4b137f4605cda5bd372bd1b6942ba5f3103f3edb7d2a971704a59df07b
MD5 93d4b10978ca42d25069703fe413b0ac
SHA1 a3765cdebcaced9166bc212bb32ee61725398488
SHA512 ae1aa2d88225253981d87e33237d40d6536d91ef6e646f7b0695455e60d20c94a4c223093b1949bb44bd28fac4c9e04e4012a2f56e06a2f103217ed0854b32ce
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2D:ImyhTWMWD
TLSH
T11A661758EA4728F1FE635972864BF37F8B20AA01C421EEF6FF09E959F43351214097A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 6.6MB
SHA256 3f943cd53be8f3429456bab13578355107688ef295085f56e1321dafc9516437
MD5 3d130ad7f43e64a37e124b7f9217e571
SHA1 f815e8d552dd20607f95cc3c91f587d259c6e9ae
SHA512 556a97743f7129c31212f036b7425e7200623d861d8d846ac594b947c6e9e7af473db207ba7af3bd8a70e4a7bb20d0e1bf47ce2ca43fbb185bfac43ffe5b7353
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH26:ImyhTWMW6
TLSH
T185660758EE4728F1FE635971864BF37F8B20AA01C421EEF6FB08E959F83351211197A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 6.8MB
SHA256 20caf2feece2e2c3ccbdd34a3b8064c628f6046320125a54309006635a13d0da
MD5 4987531e5e3df403154ebafddaa181c6
SHA1 fd3a6cd655c16ec2e4b30752d5828429a16d3ce4
SHA512 6d96ab748f9015c4c6c2c31e4a2ab777341edc85a375ba1d4209f39ad5774cbbb7f27e3465de1868fb438a8f1f1ef2ebd2da8c6533b2786f6cf9e243b3eb3c81
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2V:ImyhTWMWV
TLSH
T117660758EA4728F1FE635972864BF37F8B20AA01C421EEF6FF09E959F43351214097A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 9.4MB
SHA256 299b3f5e49d3303e0a4793fee52a1165c340a560729115f1a4d421d6f0416fa5
MD5 5e5d28b2f2bbe4e7cab4e618795e5d2e
SHA1 1518a1ef3060da0b8b37ad3369efc51f65cf93d9
SHA512 7cebf0b9fe348606d3b8cd486a8cd0f9a49111b61a0b84039eb86c7a8fa8782edee87b90d2cd61127e7729b1eff1c096f1d2728e3555031be4d2302ad7d8951d
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/gqc2d:ImyhTWMWHc2EeJUO9WLQDh
TLSH
T1F7A62955EA8B28F5EE936771818BF33F5734AE00C636EFB7FA08D525A8336821905351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 8.2MB
SHA256 372da128866add9b05a75109ec2c2ecd2e2b0071ca77bd581df238f689021545
MD5 802d3e320e8b74bbb3f1a16fa6e2b835
SHA1 5b982a70e432f705a85f87c59a1b8a8d9359193c
SHA512 3d2ea915b8ef28c2438ddf12d4b089adda37da1d13a1f184f0fd09238a4f50bc2ac9203b0d17f67d88accd4d238ea72bf966504001ac36a87f3e108f5073f33b
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/B:ImyhTWMWZ
TLSH
T110861854EA4728F5FE631671859BF33F6738AA008233EFB3EB08A965B8335D21905355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 7.5MB
SHA256 659e107cd6bbf72b9a06a85edb8961026d015443d65b78d7d5873f864cbb27d8
MD5 12504a46fc708d1f889c043da6784b60
SHA1 7f0412452bcc71864f5c401b674ede3bcf2cfea6
SHA512 25f3f9c47fe0ed717d153259500780fdef52f583e5b6ffcae1366d057beba80ebe7dd51d1a798596a51c17028e65c27c6d4a910bd84a0a82d469d882aae2be2a
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/i:ImyhTWMWq
TLSH
T14C862858EA4728F5FE631671868BF37F5724AA008132EEF7FB08E959F83355214093A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 6.9MB
SHA256 0eaa85279e4ea22b4d6c89c075d2894451347019c7a918fb02820037173c2e50
MD5 10ba96b89061812ceecc1541d078870c
SHA1 34d5388af2a798a7b9634f61acbeb64fa895ef8b
SHA512 78db8c50d4e01137c9ae9f830fde8e24e8a11136a5a2e99e4da2eb2d7339b0a91eddcf8dc42324d2f3221772c7d18261ea3537cf32f4895a0631b7db3b79eb3f
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2h:ImyhTWMWh
TLSH
T1C4761858EA4728F1FE635972864BF37F8B20AA01C421EEF6FF09E959F43351214097A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 9.3MB
SHA256 8bfd4b5016decfa8c1de3f177e90d1e818c58ad5da8da789b435e96d3b3c912b
MD5 afa28173f9fc23bc96b9ee476263ef43
SHA1 7a293ec386d9e1da9edf7cfa679f7ee2ac86142c
SHA512 02db4f4c48859fbce4d9e2079eef32cdbc87f050dfff4ce5b20cf65fa9ac152c1797db9a148daa23b836232de5d6ebca2aca90baacf2421b82aeedd3fb66161c
SSDEEP 98304:wSLKMXcBnqrOKljmGobwgXNdTb55W997J1fye3JnM5:wSGMXyBKNfobRTbAyew
TLSH
T1AAA66C13B2C4653ED0AB0B3659379954A93BB6623F138D476BFC190C6F396802E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 6.2MB
SHA256 694844e0c35366ad40152c0a0eb5eaa978911999336b5ab34e10d7170a2eb6ba
MD5 ac89bd1bf97708958da5212fc7368e84
SHA1 4e7be9341caeeb173f562f884057c931d64a1daa
SHA512 0bfce973c9f876ebc211b8275071e4384dd9cdedbd55ddbad5cdecd72923ae39e5ea53b0b23d90cad990834df51e9a01e8f17da33aa2b57918932846958a39f7
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2gF:RRL+UuGdwiu02gF
TLSH
T16E666D13B284A43EE06B2B364937D5946E3F77703A169D4B7BF4090C4F396807E2B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 6.3MB
SHA256 a74704f2213a8dc00c00a82380f692e545bd34064dd3fd670f859eeefb2a9d5f
MD5 0ca3ae37265e0b68a224e43abaaaa855
SHA1 d3350cb353440ffa393397a6bf20db05c53146fe
SHA512 f7ba371921cbb4f00f23cfd54cac32bf645eb459c7d4dc256fb916c82c8c13160f6ae0708e067f9679f87b6a9f6a8a1b487034a35832c915510c685eb06d45c3
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2ga:RRL+UuGdwiu02ga
TLSH
T125666D13B284A43EE06B2B364937D5946E3F77603A169D4B7FF4090C4F396807E2B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 6.4MB
SHA256 8864e725546f7d9b8fded35ce305959a132ad0980d10cca5ba61b15eecbfeced
MD5 2761611ab31f6f5e7412d01bac1568a4
SHA1 228e56ebdac51bda88bd1008ec6ee29b6b5d93fe
SHA512 5e4663caa08f544a6dc9728bab31466caef0521b81fbbd4b58370a14a5dded6adcec11cdcf32c1a67341c1527b1325683f36a89427df5a676baf4cd71471a404
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2gh:RRL+UuGdwiu02gh
TLSH
T16F666D13B284643EE06B2B364937D594AE3F77603A169D4B7FF4090C4F396807E2B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 7.9MB
SHA256 aa2086acf320a65c32ae69c022330c669addbf858857b427761fafe955c82934
MD5 53a69f6bf847244476d158d3f48d852e
SHA1 5aece63c9c64dd6f88e11b985e40943a138c26e9
SHA512 562c029b9daf95e0b67efc61999f5f855eacb09187f346504793a37e244c51c77feaae4dcc0ef48b4562e3e40508a6d38f834b2abd36ffd7cac26d7337f7de07
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2gbqtuRFp9BT:RRL+UuGdwiu02guteFpDT
TLSH
T15D866D13B288A43EE06B1B364C3795946E3F76713A169D4B7BF4090C4F396C07E2B696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 7.1MB
SHA256 e05b4855f33a97692bd8521f53903fc9c68505cf7013d498aab49cad62137c93
MD5 c110ff90b53a651db57968ad005805fe
SHA1 cb391683eabceb2f4284682b6c936dbcc978639f
SHA512 d764e50cc59563ef29ec54c72bce1647352445b7c29dd63a781d9fe40115cfe4a6ee6722bc06e81e42e1ff6c89ccda99c2a3c76df6b279d4125f686427d4898f
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2gbqf:RRL+UuGdwiu02guf
TLSH
T1A1766D13B284A43EE06B1B364C37D594AA3BB6713A169D4B7FF4090C4F396C07E2B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 6.5MB
SHA256 d463188fb707ded8c9a27d36bc0d31616875d0dada2b347317f41962981dadca
MD5 a19d0db8bc83da469f1f3add9179a2ca
SHA1 0554db8cac602677d11ac41e9bd0b4a3b783e0b8
SHA512 1f6446f6ad11a9379ce120bfe7910dfa11ced370306e7e6422775b686927fa8c7909c4206ee3d8a622ba277d03f457363f820c08e17a64259e8bfcec7eabcf91
SSDEEP 98304:RsBQLnN0UtyfGdWToDxUR279YJ8uTo2gM:RRL+UuGdwiu02gM
TLSH
T120666D13B284643EE06B2B364937D594AE3F77703A169D4B7BF4090C4F396807E2B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9C36.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9C36.tmp
Size 649KB
SHA256 085eacfc60a533c33950ac55f17a3afa5b7baf6e5ba73ec112adf5ed88177175
MD5 9130f41097ee2c54f979bf580706d62c
SHA1 8a31f3e18563adfef88bf9c540dc6cb7bb53ad14
SHA512 ee2f5e3ff3dbcf5dde420398193c1951a56dd8f85b8eb6c0682b89e0744e59bd56d38de9f183d93bfeb5b952e5c0116adb657cbef93e0852a05af5fa1c1088f3
SSDEEP 12288:pvEQx02n8dTBNzQGy5w8Z0IrQ9Eht74mUJEUAuh4Mqvggj+OC:pvEQiTdD2FMmUuUsYc2
TLSH
T11DE48C227A84C071E67F24326838D2715ABD78311F729BCB1798097E5F744C1AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aad5a.msi

Path C:\Windows\Installer\e5aad5a.msi
Size 12.2MB
SHA256 fbffbdddc9c0b48361ff8d84c6c057808bf13b99d2d109bda9b7bf7e905ba461
MD5 78ed6755ee11c3137aff366e126c05db
SHA1 3c7c39c4d2b95d672726da6ab488d73f1f8623de
SHA512 885b7ec16a47bc6e7e8672b20ceb5306779d07c3c1e18b7a5d436b6bf61255736e5e98d4cf2d94beb2f3b919716e980cf450bc2441bc97e110cc79d53e3e51cb
SSDEEP 196608:z0d4q8n9DC2AQZg+IQmDvo2eenESc0kNYxoXqwo2H3V92Ua:zY8phN9mDlEYxIqwFsD
TLSH
T1FDD60282F6804036DA6B153256FADE38487DFC741F6123CF2BD873396A724C15A3A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 5.9MB
SHA256 47602a2dad5f743097f668f93f76fc90553c530a76f7dcab8e2b42d5940ff05c
MD5 8d543a9d9294d292c75ad793d0b24e08
SHA1 5dad5a1bfb18fcee15d72fd4cf00e39485ebab97
SHA512 e52c6937e57f6e5b29d8206041437b1d6e15d57bae875342f4ef2ba636fe5d72a96f7cbe24f9e28cc3b26624f06e55b897783c3c4cac4a6cebeb006f3686d2d0
SSDEEP 6144:zY2x+SaX+BiXWOS9E2XK+a4T9B45K51dl/P3JJGJNEtwBPc0G7S2jFAUzm+2a3yb:0X1sDvNo3cwMiLp
TLSH
T14A56523136ED2140EBF3AE6DBCB46A248E3D7D1B5C26C94D01161A4D0961FA1DC73FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c957c883-ce23-464a-bec5-fc6fdd8071b8}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c957c883-ce23-464a-bec5-fc6fdd8071b8}_OnDiskSnapshotProp
Size 6KB
SHA256 03c367bdb73d6989e9ec47664ec2968a6d371b103c4bac864fd7c9bf92687e15
MD5 e80b66b4be6f7b22629ec9a347863ad9
SHA1 c5af2f8d640042e4f9b271c08cdac1f9867a05cd
SHA512 bb39902272e6919061061e089e5ea7154b7e18717982ca8f25d0d037a3689bd1aae7ecbb761d0cb9e8b9c25d22e3c3cd124caacfdf5bcd2e83df7aa661aa8f7b
SSDEEP 96:FhY74FXvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:bYOb++uVmN
TLSH
T15CD177184AF54711E2B3AB7128F18557A877B811EF33CB8E0198238E6671910F836F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-85-0x0000000000780000-0x00000000017BE000-memory.dmp

Download

memory/1960-86-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/2612-110-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/2612-111-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3220-105-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3220-104-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/3324-114-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/3324-115-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3324-119-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3324-118-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/3816-101-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3816-100-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/5240-91-0x00000000007D0000-0x0000000001E0C000-memory.dmp

Download

memory/5240-92-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads