rms

General

Target

c65de7ec338c53676ab215d1c7a0aa28_JaffaCakes118
Size

4.2MB
Sample

240828-hey37sybqc
MD5

c65de7ec338c53676ab215d1c7a0aa28
SHA1

45962a4f145ccb39d0168910852f7ac6bb1c68c8
SHA256

0f24c2cfba1321157b470b0812fc5eb2c3e026450e7e87428603df53a62f2756
SHA512

871a335c2a8ea7b7fc896597404fb12deb74732b49b9a0fc15fce5182a2f5d6770af2b3b53c349be568be757ea3973c410e465ef6931f6c8a98531ffc3a6b369
SSDEEP

98304:EKT338RzYf0ML2x5tTDaLclizm7KQF1iEaGzMd:EhRzYI7Da4Ii7KQrLMd

Score

10^/10

Malware Config

Targets

- Target
  
  c65de7ec338c53676ab215d1c7a0aa28_JaffaCakes118
- Size
  
  4.2MB
- MD5
  
  c65de7ec338c53676ab215d1c7a0aa28
- SHA1
  
  45962a4f145ccb39d0168910852f7ac6bb1c68c8
- SHA256
  
  0f24c2cfba1321157b470b0812fc5eb2c3e026450e7e87428603df53a62f2756
- SHA512
  
  871a335c2a8ea7b7fc896597404fb12deb74732b49b9a0fc15fce5182a2f5d6770af2b3b53c349be568be757ea3973c410e465ef6931f6c8a98531ffc3a6b369
- SSDEEP
  
  98304:EKT338RzYf0ML2x5tTDaLclizm7KQF1iEaGzMd:EhRzYI7Da4Ii7KQrLMd
Score

10^/10

rms aspackv2 discovery rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2