Extracted

• • Target

    0b91c90c90a5526fb3c023b8b5fd48db2e0a3dba4d711fc0cd69ee98028086a7

  • Size

    4.8MB

  • MD5

    f1c42547cd0c48f86d085a7140b8958c

  • SHA1

    3859fc0cb375979a07b6ed97b1a038c6b39a7249

  • SHA256

    0b91c90c90a5526fb3c023b8b5fd48db2e0a3dba4d711fc0cd69ee98028086a7

  • SHA512

    e8ac25e9fa8e4afbe3ef6c2c9547d97fc7b44a9abdfcbf158764164d9fa2adb669fdb80527e471e73f54dd4dbeb1fe379f60d94e18c4062995c581ad3c98db70

  Score

  10^/10

  rmsaspackv2collectiondiscoveryratspywarestealertrojanupx

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2