General
-
Target
cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb
-
Size
4.2MB
-
Sample
221121-3bycqabc64
-
MD5
f4b07754f4b0c67ab073b28476b809af
-
SHA1
5a4385db9a7a2878e7116f4e71ae2eeb7717bf9e
-
SHA256
cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb
-
SHA512
ebc961fcfa90e4f96191759627f308ccf1a8471a70350f3526be7b4e223b46fca6bcd90e26e59cb7327124050f6fe43aac03b93c35cb7f3f8b9d806c05d662ef
-
SSDEEP
98304:RVZb+Ma7ksZGweOjnvbE7WSW1xTAvpB+sK5/FoUS9T:Nb+CurBjjE7WSWe+sKvpS9T
Malware Config
Targets
-
-
Target
cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb
-
Size
4.2MB
-
MD5
f4b07754f4b0c67ab073b28476b809af
-
SHA1
5a4385db9a7a2878e7116f4e71ae2eeb7717bf9e
-
SHA256
cbcb0b77f06312894dfb1209aa5d967c58d248ecf6090a4e0c187290c013cabb
-
SHA512
ebc961fcfa90e4f96191759627f308ccf1a8471a70350f3526be7b4e223b46fca6bcd90e26e59cb7327124050f6fe43aac03b93c35cb7f3f8b9d806c05d662ef
-
SSDEEP
98304:RVZb+Ma7ksZGweOjnvbE7WSW1xTAvpB+sK5/FoUS9T:Nb+CurBjjE7WSWe+sKvpS9T
Score10/10-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Drops file in System32 directory
-