rms | 9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402 | Triage

Submit
Reports

Overview

overview

Static

static

8

9d6507cf35...02.exe

windows7-x64

9d6507cf35...02.exe

windows10-2004-x64

Sharing

General

Target

9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402
Size

3.8MB
Sample

221204-g1xa3adb73
MD5

9bbce6d1d7c6e8532a038d85bace05e8
SHA1

0beac56796adb0097e5ae599059de9fb07aa5d42
SHA256

9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402
SHA512

e01dcb0ddfa6dbaa775ab84e325331d02581f3c38e8c31f9f5ce087dc9d3956648cd6eb7d402589eb9d608eebe8c5ec71d99bfa9fe90420f011fe71d781b93d2
SSDEEP

98304:ZSXVRglo4U0e38BUyPgqfji/8SeQCJ6CDO:ZSCINkyq6eQCgN

Score

10^/10

rms evasion rat trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402.exe

Resource

win7-20220812-en

rms evasion rat trojan upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402.exe

Resource

win10v2004-20220901-en

rms evasion rat trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402
- Size
  
  3.8MB
- MD5
  
  9bbce6d1d7c6e8532a038d85bace05e8
- SHA1
  
  0beac56796adb0097e5ae599059de9fb07aa5d42
- SHA256
  
  9d6507cf352b404cf75753569a68f58d6c4a782fd4c0dbf8cc69a77eb5d05402
- SHA512
  
  e01dcb0ddfa6dbaa775ab84e325331d02581f3c38e8c31f9f5ce087dc9d3956648cd6eb7d402589eb9d608eebe8c5ec71d99bfa9fe90420f011fe71d781b93d2
- SSDEEP
  
  98304:ZSXVRglo4U0e38BUyPgqfji/8SeQCJ6CDO:ZSCINkyq6eQCgN
Score

10^/10

rms evasion rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rmsevasionrattrojanupx

behavioral2

rmsevasionrattrojanupx

© 2018-2025

Terms | Privacy