MITRE ATT&CKsoftware (malware)

S0148 RTM

Published 2017-05-31 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Redaman
Version
1.2
Created
2017-05-31

Description

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.

Related

Uses · MITRE ATT&CK (38)

  • T1027.015 Compression sub-technique
  • T1070.009 Clear Persistence sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1571 Non-Standard Port technique
  • T1204.002 Malicious File sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1553.004 Install Root Certificate sub-technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1056.001 Keylogging sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1518 Software Discovery technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1219 Remote Access Tools technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
Show all 38 ›

Referenced by MITRE ATT&CK · uses (1)

References