rms | a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd | Triage

Sharing

General

Target

a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd
Size

14.6MB
Sample

220128-xsjyrsbahm
MD5

c4890d57d4156c67975949591292e636
SHA1

f9b5e4bda938ca6caa483954ae898fed96b21892
SHA256

a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd
SHA512

b3680886615dbd586a77c8a9006de6df71710fb23f16d44450073234b8b5579ea01439bc9e81847baf6940f4eccf1a875135a6863e8de8e02d1fafb5316390dd

Score

10^/10

rms evasion persistence rat trojan

Malware Config

Targets

- Target
  
  a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd
- Size
  
  14.6MB
- MD5
  
  c4890d57d4156c67975949591292e636
- SHA1
  
  f9b5e4bda938ca6caa483954ae898fed96b21892
- SHA256
  
  a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd
- SHA512
  
  b3680886615dbd586a77c8a9006de6df71710fb23f16d44450073234b8b5579ea01439bc9e81847baf6940f4eccf1a875135a6863e8de8e02d1fafb5316390dd
Score

10^/10

rms evasion persistence rat trojan
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rmsevasionpersistencerattrojan

behavioral2

rmsevasionpersistencerattrojan