rms | 01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6 | Triage

Submit
Reports

Overview

overview

Static

static

01fd189da2...b6.exe

windows7_x64

01fd189da2...b6.exe

windows10-2004_x64

Sharing

General

Target

01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6
Size

7.0MB
Sample

220213-s9h1ksddak
MD5

a60b1a688fa18475288d138df20d6eaf
SHA1

c5775049ddd61859439d21a75d709dda29c8449d
SHA256

01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6
SHA512

f0f837db33ca1698eb84507bac61d9ce738f9eaf1003b7043be53f70eac6f97f5cf293c29fb6eb5ccd5097da60f57b440a52f3ae86d1d4bd07511d601eac0903

Score

10^/10

rms evasion rat trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6.exe

Resource

win7-en-20211208

rms evasion rat trojan upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6.exe

Resource

win10v2004-en-20220113

rms evasion rat trojan upx

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6
- Size
  
  7.0MB
- MD5
  
  a60b1a688fa18475288d138df20d6eaf
- SHA1
  
  c5775049ddd61859439d21a75d709dda29c8449d
- SHA256
  
  01fd189da22899dafb2e6e9e9ad9bf83b91ad78145eff7869aeea5d612ad91b6
- SHA512
  
  f0f837db33ca1698eb84507bac61d9ce738f9eaf1003b7043be53f70eac6f97f5cf293c29fb6eb5ccd5097da60f57b440a52f3ae86d1d4bd07511d601eac0903
Score

10^/10

rms evasion rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Allows Network login with blank passwords
  Allows local user accounts with blank passwords to access device from the network.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Remote Desktop Protocol

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rmsevasionrattrojanupx

behavioral2

rmsevasionrattrojanupx

© 2018-2025

Terms | Privacy