#rurat_2nd_030321

#IOC #OptiData #VR #rurat #RemoteUtilitiesLLC #EXE #UPX

https://pastebin.com/vBf6Wyr5

previous_contact:

03/03/21    https://pastebin.com/br4Cayaz

FAQ:
https://www.remoteutilities.com/download/#

attack_vector
--------------
email > attach .zip > .rar > .exe1 (UPX) > exe2 > install > service > 139.28.38.254

email_headers
--------------
Received: from mail.mepr.gov.ua (mail.menr.gov.ua [194.183.172.242])
	(envelope-from [email protected])
Received: from gmail.com (176.100.167.8) by SERV-MAIL.menr.local (10.11.12.9)
 with Microsoft SMTP Server id 14.3.498.0; Wed, 3 Mar 2021 11:05:16 +0200
From:  Кравець Олександр Олександрович <[email protected]>
Subject: Електронний запит (довіданий) Терміново!
Date: Wed, 3 Mar 2021 11:05:23 +0200

files
--------------
SHA-256		   cc9a27c8850105548515009eaef11ab3ac9f9e1d92c6cc31c7b15108ea4e2af1
File name	   Електронний запит (виправлений).zip [Zip archive data, at least v1.0 to extract]
File size	   19.92 MB (20891967 bytes)

SHA-256		   191f4a04ec57874093089f27220386272ae21ccc33941ee4d6de89a07aab3c5d
File name	   Електронний запит (виправлений).rar [RAR archive data, v9a, flags: Locked, Solid,]
File size	   19.92 MB (20891127 bytes)

SHA-256		   8c87f97def691e84a88c085c84a03074bdc3d1d193cdcd543f48b7e5173c33f8
File name	   Електронний запит (виправлений).exe [PE32 executable, UPX 2.90 [LZMA]]   ! Signed file, valid signature
File size	   20.41 MB (21401200 bytes)

SHA-256		   7d3a93970631985f561a98d1c20a4f281ca10a15c76d77637de05ffe65204f7e
File name	   unpack.exe [PE32 executable, BobSoft Mini Delphi]
File size	   22.80 MB (23912560 bytes)

installed
--------------
SHA-256		   256bce94b14c8b34a9267334670662cf02e7ec1506eb7ad520b08ceefe5a990c
File name	   host.msi [Microsoft Windows Installer]   ! Signed file, valid signature
File size	   20.49 MB (21487616 bytes)

SHA-256		   85b67377703bb2b9509d2fb895bb96d2afd42fe2e69f3d6c265f3a5e5c239598
File name	   rutserv.exe [PE32 executable, BobSoft Mini Delphi]   ! Signed file, valid signature
File size	   17.39 MB (18236152 bytes)

SHA-256		   1f54cb5415178dcb7d43c158898aed122e443a2edd15c85f525fce9cad01ae41
File name	   rfusclient.exe [ PE32 executable ]       ! Signed file, valid signature
File size	   10.71 MB (11235064 bytes)

original_utility (signed, not modified)
--------------
SHA-256		   d4d3ef9196b5dac53d1e06d738eb3e529578752bf9e8cfd2900a600d5f10a7e5
File name	   host7.0.0.1.exe [PE32 executable, UPX 2.90 [LZMA]]
File size	   20.41 MB (21397752 bytes)

activity
**************
PL_SCR		    attached exe

C2              139.28.38.254

netwrk
--------------
tcp.port == 82 || tcp.port == 5652 || tcp.port == 465

139.28.38.254		51183 → 5652 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
139.28.38.254		51184 → 82 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
139.28.38.254		51185 → 465 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

!previous contact:
tcp.port == 80 || tcp.port == 8080 || tcp.port == 5651

comp
--------------
rutserv.exe	3272	TCP	139.28.38.254	82		ESTABLISHED
rutserv.exe	3272	TCP	139.28.38.254	5652	ESTABLISHED
rutserv.exe	3272	TCP	139.28.38.254	465		SYN_SENT

proc
--------------
C:\Users\operator\Desktop\Електронний запит (виправлений).exe
C:\Users\operator\Desktop\Електронний запит (виправлений).exe
	"C:\Windows\System32\msiexec.exe" /i "C:\Users\support\AppData\Local\Temp\RUT_{E19EF340-B780-42C7-811E-A23FDB7ACC79}\host.msi" /qn

[another context]

C:\Windows\system32\msiexec.exe /V
	C:\Windows\syswow64\MsiExec.exe -Embedding 031534DEB1A1D91B51BB52E296CE2215
	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\support\AppData\Local\Temp\RUT_{E19EF340-B780-42C7-811E-A23FDB7ACC79}\host.msi"
	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start

"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
		"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall

persist
--------------
HKLM\System\CurrentControlSet\Services				03.03.2021 11:39

RManService	Allows Remote Utilities users to connect to this machine.	Remote Utilities LLC
c:\program files (x86)\remote utilities - host\rutserv.exe	28.02.2021 14:25

"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service

drop
--------------
C:\ProgramData\Remote Utilities\msi\70001_{CE1C66C6-55D6-4DAE-98B7-B8C7FE87342D}\host.msi
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

# # #
https://www.virustotal.com/gui/file/cc9a27c8850105548515009eaef11ab3ac9f9e1d92c6cc31c7b15108ea4e2af1/details
https://www.virustotal.com/gui/file/191f4a04ec57874093089f27220386272ae21ccc33941ee4d6de89a07aab3c5d/details
https://www.virustotal.com/gui/file/8c87f97def691e84a88c085c84a03074bdc3d1d193cdcd543f48b7e5173c33f8/details
https://www.virustotal.com/gui/file/7d3a93970631985f561a98d1c20a4f281ca10a15c76d77637de05ffe65204f7e/details

installed
https://www.virustotal.com/gui/file/256bce94b14c8b34a9267334670662cf02e7ec1506eb7ad520b08ceefe5a990c/details
https://www.virustotal.com/gui/file/85b67377703bb2b9509d2fb895bb96d2afd42fe2e69f3d6c265f3a5e5c239598/details
https://www.virustotal.com/gui/file/1f54cb5415178dcb7d43c158898aed122e443a2edd15c85f525fce9cad01ae41/details

original_utility
https://www.virustotal.com/gui/file/d4d3ef9196b5dac53d1e06d738eb3e529578752bf9e8cfd2900a600d5f10a7e5/details

VR