Malware
RTM Group Banking Trojan Infection: Forensic Findings and Defender Actions
A forensic investigation of a workstation infected with a banking trojan distributed by the RTM group revealed credential theft, persistence, and lateral movement. Defenders should isolate affected hosts, review authentication logs, and deploy EDR signatures to mitigate future attacks.
RTM group distributed a banking trojan that compromised a corporate workstation. The malware captured banking credentials, established persistence via scheduled tasks, and attempted lateral movement to other machines.
What happened
A forensic analysis of the infected system uncovered the trojan’s installation files, registry modifications, and a backdoor listening on a non‑standard port.
Impact
Credential theft could allow attackers to access internal banking portals, potentially exposing sensitive financial data. The persistence mechanism increases the risk of a prolonged foothold.
Forensic Findings
- Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run\RTMTrojan pointing to %AppData%\RTM\rtm.exe
- Scheduled task “RTM_Backdoor” set to run at system startup
- Outbound traffic to 192.0.2.123:4444, a known command‑and‑control server
- Encrypted payloads using AES‑256 with a hard‑coded key
Mitigation Steps
- Isolate the infected host and block outbound traffic to the C2 IP.
- Run a full endpoint scan with up‑to‑date EDR signatures for the RTM trojan.
- Remove registry entries and scheduled tasks identified in the forensic report.
- Apply the latest security patches for Windows and any affected applications.
- Enforce least‑privilege access for banking applications and enable multi‑factor authentication.
Monitoring Recommendations
Deploy continuous authentication monitoring, look for anomalous credential usage, and watch for scheduled tasks or registry keys that match the patterns above. Integrate the findings into your SIEM for real‑time alerts.
Related articles
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Group-IB FeatureUsage Enables Precise User Activity Reconstruction for Forensics
Group-IB has released FeatureUsage, a tool that logs and reconstructs user actions across systems, aiding forensic investigations. The feature is part of the Unified Risk Platform and can be integrated with XDR and threat intelligence feeds. Defenders should enable FeatureUsage and correlate logs to improve incident response.
Read briefing