rms

General

Target

0E019C3CFEF287B794675809D032037A.exe
Size

3.9MB
Sample

250201-wbx9dssrfv
MD5

0e019c3cfef287b794675809d032037a
SHA1

6eb0a8128b5316bf83b9012ea0e970ca307cab95
SHA256

c42d8d577ec96bccfcb249738c559d47494e7b6de794259663e2c70f7c47bddc
SHA512

870fa65571e2213c58af68de97a56bc2ce49334ad740af603dc7c82ef6c5603103ef0a62911d2197412edf55a0f93fc9665da71da9803f828bbb77f317b13c70
SSDEEP

98304:beZIXSqVHHhmqNaCZMhEgh3hCRS0fFF3tplnICLluBFBrf:YqVoqNaCZBwsRS09xtvIusBr

Score

10^/10

Malware Config

Targets

- Target
  
  0E019C3CFEF287B794675809D032037A.exe
- Size
  
  3.9MB
- MD5
  
  0e019c3cfef287b794675809d032037a
- SHA1
  
  6eb0a8128b5316bf83b9012ea0e970ca307cab95
- SHA256
  
  c42d8d577ec96bccfcb249738c559d47494e7b6de794259663e2c70f7c47bddc
- SHA512
  
  870fa65571e2213c58af68de97a56bc2ce49334ad740af603dc7c82ef6c5603103ef0a62911d2197412edf55a0f93fc9665da71da9803f828bbb77f317b13c70
- SSDEEP
  
  98304:beZIXSqVHHhmqNaCZMhEgh3hCRS0fFF3tplnICLluBFBrf:YqVoqNaCZBwsRS09xtvIusBr
Score

10^/10

rms aspackv2 discovery rat trojan upx
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Rms family
  rms
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Rms family

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2