S0148: RTM
Analyst context for executives and security teams
RTM is a Windows malware family written in Delphi and associated in ATT&CK with the RTM cybercriminal group. Its mapped behaviors matter because they combine credential and user-data collection, host discovery, persistence, command-and-control, and cleanup/stealth techniques. For leaders, the practical issue is not only whether a signature exists, but whether the organization can see and investigate Windows activity that looks like banking-trojan-style credential theft and persistence.
Executive priority
Prioritize RTM as a validation case for Windows endpoint resilience, identity risk, and incident response readiness. The ATT&CK relationships show behaviors that can affect credential exposure, fraud risk, and investigation quality: keylogging, screen and clipboard collection, scheduled task persistence, registry modification, web-based C2, ingress tool transfer, obfuscation, masquerading, and file/persistence cleanup. Executives should ask whether SOC coverage is behavior-based, whether evidence survives cleanup attempts, and whether high-risk financial or remote-banking users receive stronger monitoring and access controls.
Technical view
ATT&CK does not provide an official detection section for RTM, so coverage should be validated against the mapped techniques rather than a single malware name. On Windows, focus on suspicious scheduled task creation or modification, registry changes linked to persistence or defense evasion, command shell execution, user/system/process/file discovery, and collection behaviors such as keylogging, screen capture, clipboard access, and automated collection. Network teams should validate visibility into outbound web-protocol C2 patterns and use of legitimate web services as dead-drop resolvers. IR teams should also plan for obfuscated/compressed payloads, masqueraded task or service names, file deletion, and clearing of persistence artifacts.
Likely telemetry
- Windows endpoint process creation and command-line events, especially cmd.exe and discovery command patterns
- Windows Task Scheduler events and task XML/name/description changes
- Windows Registry modification telemetry for persistence- and defense-evasion-relevant keys
- File creation, deletion, compression/archive, and executable metadata telemetry on endpoints
- Endpoint alerts or behavioral telemetry for keyboard, screen capture, clipboard, and automated collection activity
Detection direction
- Because MITRE provides no official RTM detection text, build detections around technique clusters: persistence plus masquerading, discovery plus collection, and web C2 plus tool transfer.
- Tune scheduled-task detections for suspicious task names, descriptions, paths, or timing, while accounting for legitimate administrative and software-update tasks.
- Correlate registry modification, task creation, and command shell execution from the same host or user context to reduce false positives.
- Look for discovery activity followed by credential or collection behavior, including keylogging, screen capture, clipboard access, or automated file collection.
- Review network detections for outbound HTTP/S patterns that blend into normal traffic, including contacts to legitimate external services that may act as dead-drop resolvers.
Mitigation priorities
- Confirm Windows endpoint logging and EDR coverage for task scheduling, registry modification, process creation, file deletion, and suspicious collection behavior.
- Harden persistence surfaces by limiting who can create scheduled tasks or modify sensitive registry locations, and review administrative access regularly.
- Reduce credential-theft impact with strong identity controls for high-risk users, especially users of remote banking or financial systems.
- Apply egress monitoring and filtering appropriate to business requirements, with attention to unusual HTTP/S destinations and web-service-based resolver behavior.
- Prepare IR playbooks to preserve volatile endpoint evidence quickly, because the mapped techniques include file deletion and clearing persistence artifacts.
Analyst notes and limits
The supplied ATT&CK object identifies RTM as custom Delphi malware, newer versions publicly reported as Redaman, and links it to the RTM group. Relationship context maps RTM to multiple ATT&CK techniques across stealth, discovery, execution, persistence, credential access, collection, and command-and-control behaviors. The group description states interest in users of remote banking systems in Russia and neighboring countries; this should inform threat-intelligence context without being treated as proof of local exposure.
No official MITRE detection guidance is provided for this object, and the object itself lists Windows as the platform with no object-level tactics specified. Technique relationship descriptions include broader platform coverage, but this take treats RTM coverage as Windows-focused unless local intelligence supports otherwise. Local telemetry, asset criticality, user population, and incident evidence are required to determine actual risk or detection coverage.
RTM
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
Groups, software, and campaigns
G0048: RTM
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | cfbd4a3aa638… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
ESET RTM Feb 2017
Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
Open source URL -
[2]
Unit42 Redaman January 2019
Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
Open source URL -
[3]
Redaman
(Citation: Unit42 Redaman January 2019)
-
[4]
mitre-attack S0148Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.