ESET RTM Feb 2017

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

RTM can obtain the victim username and permissions.

RTM tries to add a scheduled task to establish persistence.

RTM can record keystrokes from both the keyboard and virtual keyboard.

RTM can obtain information about process integrity levels.

RTM uses the command line and rundll32.exe to execute.

RTM can delete all files created during its execution.

RTM has the ability to remove Registry entries that it created for persistence.

RTM can obtain the computer name, OS version, and default language identifier.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.

RTM can download additional files.

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.

RTM can delete all Registry entries created during its execution.

RTM can capture screenshots.

RTM collects data from the clipboard.

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.

RTM can obtain a list of smart card readers attached to the victim.

RTM can obtain the victim time zone.

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.

RTM runs its core DLL file using rundll32.exe.

RTM has the capability to download a VNC module from command and control (C2).

RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

RTM can obtain information about security software on the victim.

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.

RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.

RTM samples have been signed with a code-signing certificates.

RTM can add a certificate to the Windows store.

RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.

RTM used Port 44443 for its VNC module.

RTM encrypts C2 traffic with a custom RC4 variant.