Overview

overview

10

Static

static

7ef66146ae...15.exe

windows7_x64

10

7ef66146ae...15.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ef66146ae2b92c2de05e426e5751c8e699a82447eceb5d687ffe548fdc87515

  • Size

    4.9MB

  • Sample

    210504-pya7jpqms6

  • MD5

    a45684d66edde7fe4b48cf93c4fcd515

  • SHA1

    e21d87bd70302a3bf6d495264c2ee163944cf537

  • SHA256

    7ef66146ae2b92c2de05e426e5751c8e699a82447eceb5d687ffe548fdc87515

  • SHA512

    0892eb186b1128e7ec63c14db43cb56bb268fe68a3b6d072a49ea95ac86f96c296f2e075aaf09999a24dff47c8dc4e278c259ef3f2a566e360733fb086aad7bf

Score
10/10
rmsaspackv2evasionrattrojanupx

Malware Config

Targets

    • Target

      7ef66146ae2b92c2de05e426e5751c8e699a82447eceb5d687ffe548fdc87515

    • Size

      4.9MB

    • MD5

      a45684d66edde7fe4b48cf93c4fcd515

    • SHA1

      e21d87bd70302a3bf6d495264c2ee163944cf537

    • SHA256

      7ef66146ae2b92c2de05e426e5751c8e699a82447eceb5d687ffe548fdc87515

    • SHA512

      0892eb186b1128e7ec63c14db43cb56bb268fe68a3b6d072a49ea95ac86f96c296f2e075aaf09999a24dff47c8dc4e278c259ef3f2a566e360733fb086aad7bf

    Score
    10/10
    rmsaspackv2evasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks