Procedure examples

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

RTM can obtain the victim username and permissions.

RTM has been delivered as archived Windows executable files masquerading as PDF documents.

RTM has named the scheduled task it creates "Windows Update".

RTM tries to add a scheduled task to establish persistence.

RTM can record keystrokes from both the keyboard and virtual keyboard.

RTM can obtain information about process integrity levels.

RTM uses the command line and rundll32.exe to execute.

RTM can delete all files created during its execution.

RTM has the ability to remove Registry entries that it created for persistence.

RTM has initiated connections to external domains using HTTPS.

RTM can obtain the computer name, OS version, and default language identifier.

RTM can check for specific files and directories associated with virtualization and malware analysis.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

RTM can download additional files.

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.

RTM can delete all Registry entries created during its execution.

RTM can capture screenshots.

RTM collects data from the clipboard.

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.

RTM can obtain a list of smart card readers attached to the victim.

RTM can obtain the victim time zone.

RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

RTM runs its core DLL file using rundll32.exe.

RTM has the capability to download a VNC module from command and control (C2).

RTM can detect if it is running within a sandbox or other virtualized analysis environment.

RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

RTM can obtain information about security software on the victim.

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.

RTM samples have been signed with a code-signing certificates.

RTM can add a certificate to the Windows store.

RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.

RTM has been delivered via spearphishing attachments disguised as PDF documents.

RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.

RTM used Port 44443 for its VNC module.

RTM encrypts C2 traffic with a custom RC4 variant.