Search/RTM
● Malware

RTM

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
39 relationships
T1053.005: Scheduled Task
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1218.011: Rundll32
source
T1056.001: Keylogging
source
T1548.002: Bypass User Account Control
source
T1559.002: Dynamic Data Exchange
source
T1204.002: Malicious File
source
T1573.001: Symmetric Cryptography
source
T1566.001: Spearphishing Attachment
source
T1119: Automated Collection
source
T1115: Clipboard Data
source
T1553.002: Code Signing
source
T1120: Peripheral Device Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1219: Remote Access Tools
source
T1036: Masquerading
source
T1112: Modify Registry
source
T1083: File and Directory Discovery
source
T1568: Dynamic Resolution
source
T1036.004: Masquerade Task or Service
source
T1497: Virtualization/Sandbox Evasion
source
T1057: Process Discovery
source
T1547.001: Registry Run Keys / Startup Folder
source
T1571: Non-Standard Port
source
T1027: Obfuscated Files or Information
source
T1553.004: Install Root Certificate
source
T1518.001: Security Software Discovery
source
T1059.003: Windows Command Shell
source
T1070.009: Clear Persistence
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1518: Software Discovery
source
T1105: Ingress Tool Transfer
source
T1124: System Time Discovery
source
T1102.001: Dead Drop Resolver
source
T1027.015: Compression
source