MALWARE FAMILY

RTM

Internal ID: win.rtm

aliases

Last seen:Mar 17, 2026

Intelligence Profile

RTM Banker also known as Redaman was first blogged about in February 2017 by ESET. The malware is written in Delphi and shows some similarities (like process list) with Buhtrap. It uses a slightly modified version of RC4 to encrypt its strings, network data, configuration and modules, according to ESET.

Threat Analysis

RTM is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.peppermalware.com/2019/11/brief-analysis-of-redaman-banking.html

→https://jonahacks.medium.com/malware-analysis-manual-unpacking-of-redaman-ec1782352cfb

→https://securelist.com/financial-cyberthreats-in-2020/101638/

→https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/

→https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/

→https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/

→https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf

→https://www.youtube.com/watch?v=YXnNO3TipvM

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.rtm

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search RTM