RTM
Software · ATTACK:enterprise:S0148
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0148",
"title": "RTM",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0148",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--92ec0cbd-2c30-44a2-b270-73f4ec949841",
"external_id": "S0148",
"domain": "enterprise",
"created": "2017-05-31T21:33:26.565Z",
"modified": "2025-04-16T20:38:23.633Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Redaman"
},
{
"source_name": "Unit42 Redaman January 2019",
"url": "https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"
},
{
"source_name": "ESET RTM Feb 2017",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
}
]
}Explicit source assertions (39)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d0b4507-b600-41f1-be98-03909e5d99cf
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14e8774f-a443-4065-b44d-5bb13b467c7c
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca68d88-a287-4c48-a4f8-68611eceb445
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e03e95c-1c9a-4fa8-9d6d-b5d244b06509
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23e2dc58-4b8d-48d8-82fd-d051892a7d58
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25eb9cd3-80e1-4116-bfd3-fa3819dc2079
CheckPoint Redaman October 2019 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b948c49-f65d-4e60-969f-229030b4d311
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--349f297f-48bf-4105-b92c-960c56aaaacf
Unit42 Redaman January 2019 · ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37dd9a3c-dd52-4541-be7c-b490d026305c
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45f9e4b6-a6a0-4f9f-aae9-9e8a69f5681d
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c3890f0-378d-4cef-8db7-0258161ff3f7
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6975d10a-91bf-4a22-8353-745de444c594
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b0b404e-7e1b-4f8f-8b78-85016f36f8e9
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73d5e6ab-9d0c-4884-9db0-02033523e61a
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84e0c62b-b1a6-4ecd-8607-f0b516cb48f6
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--874d4046-5b9a-4f60-88f4-79ae63a70a1e
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87fb2671-e71a-4630-bde2-67e546fdeaa6
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94b4de9a-1f83-4923-8d4b-e9bafdb1bef9
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--954c6284-d1eb-48f1-96a4-1ed81b063d82
ESET RTM Feb 2017 · CheckPoint Redaman October 2019 · Unit42 Redaman January 2019ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:S0148
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9755e169-0dd5-4bf5-a884-d50d31f33ad9
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ae8ed36-348a-4053-bfa2-81fd0cc774aa
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a83182d2-b619-4ca4-984b-21ecfe43da26
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aad1cfa0-0df0-4768-87c2-5e59da2c5e44
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1553.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af74c0ec-0bbe-4538-a3a3-1e967afd3d51
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1c26420-ee32-44db-9158-781d38d7cc3b
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b258b8da-ddd2-4f0e-b5da-83a89f018d54
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2848d62-76a1-465c-b12e-7dc3113e6bbe
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6606ced-4641-451f-ac2a-493b1d15d0aa
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c839344c-a96d-412f-bded-5ac7c8fd446a
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d412ff4a-d9d0-44a9-b8b3-36a650f18036
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5c86dd3-3cfa-4ade-8984-fdf079b9f81b
Unit42 Redaman January 2019 · ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7903e1f-f31c-48bc-b7c3-3616cb1a792f
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0b775d4-cfc4-4075-a72b-6a866ef3c159
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0cf3ea2-5345-48d7-9685-be0180eb0e4a
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f60ed279-c720-4906-9e63-3cd7ce49e1e0
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6d23c00-158e-4e39-bf9b-f18344cd0151
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7873bae-95b2-4463-808f-8f9d5c9deb8e
ESET RTM Feb 2017ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f981c633-9333-4c7d-a168-7bea28f64d52
Unit42 Redaman January 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe4ed27a-6d45-4e6a-bbc0-7ebe15a38046
ESET RTM Feb 2017 · Unit42 Redaman January 2019