rms

General

Target

8252f89c2ff4e706e74bbd2677e0b1c2f4be2559bbaed0853a440f79ffbb2419
Size

4.5MB
Sample

220725-d9mansdca7
MD5

5086b86dfd16f64af55cb6f5a6fccd6d
SHA1

05b0495d61c9b127c25d9f7f2f808fad3919d1c9
SHA256

8252f89c2ff4e706e74bbd2677e0b1c2f4be2559bbaed0853a440f79ffbb2419
SHA512

bfd30d2bcfee0a776c2b47d5d569c57e4efea7782bc62fdd10a691f26f954fe837ff1c28a67df7822161ad8fb7fb23e97310ea6796722b94d2fb8180fed9cb18

Score

10^/10

Malware Config

Targets

- Target
  
  8252f89c2ff4e706e74bbd2677e0b1c2f4be2559bbaed0853a440f79ffbb2419
- Size
  
  4.5MB
- MD5
  
  5086b86dfd16f64af55cb6f5a6fccd6d
- SHA1
  
  05b0495d61c9b127c25d9f7f2f808fad3919d1c9
- SHA256
  
  8252f89c2ff4e706e74bbd2677e0b1c2f4be2559bbaed0853a440f79ffbb2419
- SHA512
  
  bfd30d2bcfee0a776c2b47d5d569c57e4efea7782bc62fdd10a691f26f954fe837ff1c28a67df7822161ad8fb7fb23e97310ea6796722b94d2fb8180fed9cb18
Score

10^/10

rms aspackv2 evasion rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Executes dropped EXE

Sets file to hidden

UPX packed file

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2