Overview

overview

10

Static

static

bc3758b469...44.exe

windows7_x64

10

bc3758b469...44.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44

  • Size

    4.3MB

  • Sample

    220516-cgsrbacbcq

  • MD5

    037e9f1ec832baabe53323cbd57603c6

  • SHA1

    89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35

  • SHA256

    bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44

  • SHA512

    16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68

Score
10/10
rmsaspackv2rattrojanupx

Malware Config

Targets

    • Target

      bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44

    • Size

      4.3MB

    • MD5

      037e9f1ec832baabe53323cbd57603c6

    • SHA1

      89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35

    • SHA256

      bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44

    • SHA512

      16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68

    Score
    10/10
    rmsaspackv2rattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks