Overview

overview

10

Static

static

cb37229f83...29.exe

windows7_x64

10

cb37229f83...29.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29

  • Size

    4.0MB

  • Sample

    220524-sbmwwafce8

  • MD5

    acf3ffe4ef28ee077026078d3aef11be

  • SHA1

    3e349d572a82b1df3bd61970640aa50ef6bbed78

  • SHA256

    cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29

  • SHA512

    00715f0162e8490a743eb307be942373528347e5b9cdfa92b5ab63c16d03ebac2a3925b54e40ad3e7023b2b0b6f9ffb71f09d213b76b7fc7245bae24ebfd0b72

Score
10/10
rmsaspackv2rattrojanupx

Malware Config

Targets

    • Target

      cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29

    • Size

      4.0MB

    • MD5

      acf3ffe4ef28ee077026078d3aef11be

    • SHA1

      3e349d572a82b1df3bd61970640aa50ef6bbed78

    • SHA256

      cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29

    • SHA512

      00715f0162e8490a743eb307be942373528347e5b9cdfa92b5ab63c16d03ebac2a3925b54e40ad3e7023b2b0b6f9ffb71f09d213b76b7fc7245bae24ebfd0b72

    Score
    10/10
    rmsrattrojanaspackv2upx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks