Overview

overview

10

Static

static

c064d09a29...f6.exe

windows7_x64

10

c064d09a29...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c064d09a297505651165e233a9e2d2334a8d17dc704c04ef1c94c00e9210b5f6

  • Size

    6.9MB

  • Sample

    220502-v4jq2abeh2

  • MD5

    4d6acaebfb4796437e1d47ed47181077

  • SHA1

    3c10a174e0c343cefbeaa5f034d6a83c70143f2c

  • SHA256

    c064d09a297505651165e233a9e2d2334a8d17dc704c04ef1c94c00e9210b5f6

  • SHA512

    7653185adbf7345a541b5833b4c6cf3906fd1624b7c66c18fb8e1e48e9e8947b87cca07d35b07cb408324c75ab7be292bd79c08a374a22b1fa80ab9fffb590ca

Score
10/10
rmsaspackv2rattrojanupx

Malware Config

Targets

    • Target

      c064d09a297505651165e233a9e2d2334a8d17dc704c04ef1c94c00e9210b5f6

    • Size

      6.9MB

    • MD5

      4d6acaebfb4796437e1d47ed47181077

    • SHA1

      3c10a174e0c343cefbeaa5f034d6a83c70143f2c

    • SHA256

      c064d09a297505651165e233a9e2d2334a8d17dc704c04ef1c94c00e9210b5f6

    • SHA512

      7653185adbf7345a541b5833b4c6cf3906fd1624b7c66c18fb8e1e48e9e8947b87cca07d35b07cb408324c75ab7be292bd79c08a374a22b1fa80ab9fffb590ca

    Score
    10/10
    rmsaspackv2rattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks