rms

General

Target

3a01334c9468a34077bdec51f056069b9d05f225a4d4e4248c04d2c8d58ad5f2
Size

4.0MB
Sample

220311-btybwsecd2
MD5

5b9d3edb139601988e8bf59722ccc314
SHA1

e4ce3ff18a2a3171b235b996e8c6e6a128aa040b
SHA256

3a01334c9468a34077bdec51f056069b9d05f225a4d4e4248c04d2c8d58ad5f2
SHA512

0bd5029b36f911c7d1420f7ace0d40b010d258341c94e8cab0c4387397f4865c68696cb61628119a4ee080023fc4657a979fcb0ad1dd1bf06dc9fe4cf66dd501

Score

10^/10

Malware Config

Targets

- Target
  
  3a01334c9468a34077bdec51f056069b9d05f225a4d4e4248c04d2c8d58ad5f2
- Size
  
  4.0MB
- MD5
  
  5b9d3edb139601988e8bf59722ccc314
- SHA1
  
  e4ce3ff18a2a3171b235b996e8c6e6a128aa040b
- SHA256
  
  3a01334c9468a34077bdec51f056069b9d05f225a4d4e4248c04d2c8d58ad5f2
- SHA512
  
  0bd5029b36f911c7d1420f7ace0d40b010d258341c94e8cab0c4387397f4865c68696cb61628119a4ee080023fc4657a979fcb0ad1dd1bf06dc9fe4cf66dd501
Score

10^/10

rms aspackv2 rat spyware stealer trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

NirSoft WebBrowserPassView

Nirsoft

ASPack v2.12-2.42

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2