rms

General

Target

2534EECCA5ED157444298473D7C9C82D9DEF5B0A93AC5.exe
Size

13.1MB
Sample

211123-g12wjsced3
MD5

e957c04fe7176fc386d68f693293a2b7
SHA1

463c20d755a29323e8994d8edd2c1984c403611b
SHA256

2534eecca5ed157444298473d7c9c82d9def5b0a93ac581b75dede2f1a0c0a56
SHA512

a25ae8913d4be469dec0a7ede29e59d63d84cb223dd570b804b7dcdce1f0c35c9739e3c2a1c56191aca80618c12e2924ea60957064edcbb36f1abd7b1c4c4080

Score

10^/10

Malware Config

Targets

- Target
  
  2534EECCA5ED157444298473D7C9C82D9DEF5B0A93AC5.exe
- Size
  
  13.1MB
- MD5
  
  e957c04fe7176fc386d68f693293a2b7
- SHA1
  
  463c20d755a29323e8994d8edd2c1984c403611b
- SHA256
  
  2534eecca5ed157444298473d7c9c82d9def5b0a93ac581b75dede2f1a0c0a56
- SHA512
  
  a25ae8913d4be469dec0a7ede29e59d63d84cb223dd570b804b7dcdce1f0c35c9739e3c2a1c56191aca80618c12e2924ea60957064edcbb36f1abd7b1c4c4080
Score

10^/10

rms aspackv2 discovery evasion exploit miner persistence rat spyware stealer trojan upx xmrig
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detected Stratum cryptominer command
  Looks to be attempting to contact Stratum mining pool.
  miner
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- XMRig Miner Payload
  miner
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Sets DLL path for service in the registry
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- autoit_exe
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2