rms | a151e201eef789f2f07854f967286de25a1ceeef7657e0c5e6b655af12e23ca5 | Triage

Submit
Reports

Overview

overview

Static

static

3

c2e68d0204...18.exe

windows7-x64

c2e68d0204...18.exe

windows10-2004-x64

Sharing

General

Target

c2e68d0204a75aa1f1f0615ec8883a67_JaffaCakes118
Size

4.5MB
Sample

240826-nl46pasfjr
MD5

c2e68d0204a75aa1f1f0615ec8883a67
SHA1

847dc490286760dd92fa8b95946c283ff4b0032e
SHA256

a151e201eef789f2f07854f967286de25a1ceeef7657e0c5e6b655af12e23ca5
SHA512

3653a2eb66c8a96905d223a7ec7d7e997fb3bcfa2cd626a05e12ee2a23b7bfa1ef89dc9205934c38e47e58030d0318e063fe8ce806cb2397f7bec78428508b39
SSDEEP

98304:HKF7KQF1iEaGzM038RzYf0ML2x5tTDaLclizt5C1:HS7KQrLM/RzYI7Da4Im

Score

10^/10

rms aspackv2 discovery evasion rat trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c2e68d0204a75aa1f1f0615ec8883a67_JaffaCakes118.exe

Resource

win7-20240708-en

rms aspackv2 discovery evasion rat trojan upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

c2e68d0204a75aa1f1f0615ec8883a67_JaffaCakes118.exe

Resource

win10v2004-20240802-en

rms aspackv2 discovery evasion rat trojan upx

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  c2e68d0204a75aa1f1f0615ec8883a67_JaffaCakes118
- Size
  
  4.5MB
- MD5
  
  c2e68d0204a75aa1f1f0615ec8883a67
- SHA1
  
  847dc490286760dd92fa8b95946c283ff4b0032e
- SHA256
  
  a151e201eef789f2f07854f967286de25a1ceeef7657e0c5e6b655af12e23ca5
- SHA512
  
  3653a2eb66c8a96905d223a7ec7d7e997fb3bcfa2cd626a05e12ee2a23b7bfa1ef89dc9205934c38e47e58030d0318e063fe8ce806cb2397f7bec78428508b39
- SSDEEP
  
  98304:HKF7KQF1iEaGzM038RzYf0ML2x5tTDaLclizt5C1:HS7KQrLM/RzYI7Da4Im
Score

10^/10

rms aspackv2 discovery evasion rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rmsaspackv2discoveryevasionrattrojanupx

behavioral2

rmsaspackv2discoveryevasionrattrojanupx

© 2018-2024

Terms | Privacy