Overview

overview

10

Static

static

6b1993fe36...90.exe

windows7_x64

10

6b1993fe36...90.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b1993fe3607e7903ec2eb3c28325a33bf9dd7f0e10dced73127d67e59e2c190

  • Size

    4.6MB

  • Sample

    220520-z3a5qagehj

  • MD5

    92cc670966533412a28905554e3ffd17

  • SHA1

    811d7fe266fa3412233eb3c03f7261020c22a39a

  • SHA256

    6b1993fe3607e7903ec2eb3c28325a33bf9dd7f0e10dced73127d67e59e2c190

  • SHA512

    22237b3e13b0957615081faf79e15bc9a1632202273e7754f5fcfb3da0e9c057d107a2b70a5aa5bf7c5572aa31be157e801582dfc4b0ad1a67608c0c462570bf

Score
10/10
rmsaspackv2evasionrattrojanupx

Malware Config

Targets

    • Target

      6b1993fe3607e7903ec2eb3c28325a33bf9dd7f0e10dced73127d67e59e2c190

    • Size

      4.6MB

    • MD5

      92cc670966533412a28905554e3ffd17

    • SHA1

      811d7fe266fa3412233eb3c03f7261020c22a39a

    • SHA256

      6b1993fe3607e7903ec2eb3c28325a33bf9dd7f0e10dced73127d67e59e2c190

    • SHA512

      22237b3e13b0957615081faf79e15bc9a1632202273e7754f5fcfb3da0e9c057d107a2b70a5aa5bf7c5572aa31be157e801582dfc4b0ad1a67608c0c462570bf

    Score
    10/10
    rmsaspackv2evasionrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks