General
- Target agent6.10.exe
- Size 11.6MB
- Sample261014-arpraswtdy
- SHA256 80891894b7894e600f8d6fadb1978d847959e33456f7d292f7f5482f9e5fcd8d
Score
10/10
Malware Config
Targets
-
- Target agent6.10.exe
- Size 11.6MB
- SHA256 80891894b7894e600f8d6fadb1978d847959e33456f7d292f7f5482f9e5fcd8d
Score10/10Family: RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1