General
- Target payment-order-redacted-286.pdf
- Size 376KB
- Sample261104-zm5pdsef87
- SHA256 de92bb09e956a1e5eae07a3ce5c440209e4c931b8c9580edc12b0aacaeeefeb1
Score
10/10
Malware Config
Targets
-
- Target payment-order-redacted-286.pdf
- Size 376KB
- SHA256 de92bb09e956a1e5eae07a3ce5c440209e4c931b8c9580edc12b0aacaeeefeb1
Score10/10Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1