rms

General

Target

037e9f1ec832baabe53323cbd57603c6_JaffaCakes118
Size

4.3MB
Sample

240427-yjzhjafb29
MD5

037e9f1ec832baabe53323cbd57603c6
SHA1

89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35
SHA256

bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44
SHA512

16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68
SSDEEP

98304:ucMkgLrnO38RzYf0ML2x5tTDaLclizm7KQF1iEaGzMU+:u/kgLz9RzYI7Da4Ii7KQrLMU+

Score

10^/10

Malware Config

Targets

- Target
  
  037e9f1ec832baabe53323cbd57603c6_JaffaCakes118
- Size
  
  4.3MB
- MD5
  
  037e9f1ec832baabe53323cbd57603c6
- SHA1
  
  89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35
- SHA256
  
  bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44
- SHA512
  
  16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68
- SSDEEP
  
  98304:ucMkgLrnO38RzYf0ML2x5tTDaLclizm7KQF1iEaGzMU+:u/kgLz9RzYI7Da4Ii7KQrLMU+
Score

10^/10

rms aspackv2 rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2