rms | dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8 | Triage

Submit
Reports

Overview

overview

Static

static

dac68e2f9d...c8.exe

windows7_x64

dac68e2f9d...c8.exe

windows10-2004_x64

Sharing

General

Target

dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8
Size

16.3MB
Sample

220309-e4vkjaddh4
MD5

e43ee6c5054feb07a7ff7d218e50b5f4
SHA1

349856aaa3a026768369e0d0a113ffa2287c2852
SHA256

dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8
SHA512

8f43cb072fe37eb859d9f4b019dd45d441b3f9421a8d931c1d6e4d76c1f81eda56bfc8d70996b3dab4e5d54e6cb978943e9f5643b0ffe90e4a98ed9798d5de46

Score

10^/10

rms evasion persistence rat trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8.exe

Resource

win7-20220223-en

rms evasion persistence rat trojan upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8.exe

Resource

win10v2004-en-20220113

evasion persistence trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8
- Size
  
  16.3MB
- MD5
  
  e43ee6c5054feb07a7ff7d218e50b5f4
- SHA1
  
  349856aaa3a026768369e0d0a113ffa2287c2852
- SHA256
  
  dac68e2f9df041aacd69b3f29a37c5d2de0c38638772b9ab973d0f242febc4c8
- SHA512
  
  8f43cb072fe37eb859d9f4b019dd45d441b3f9421a8d931c1d6e4d76c1f81eda56bfc8d70996b3dab4e5d54e6cb978943e9f5643b0ffe90e4a98ed9798d5de46
Score

10^/10

rms evasion persistence rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- UAC bypass
  evasion trojan
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

rmsevasionpersistencerattrojanupx

behavioral2

evasionpersistencetrojan

© 2018-2025

Terms | Privacy