PUP.TacticalRMM
Table of Contents
Analysis Report
General information
| Family Name: | PUP.TacticalRMM |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6a5e53cda82dd4dcb0f9312bb9d70718
SHA1:
0eceeb987206961b61e4979383a24f32d24171f0
SHA256:
D9957033E0C39D8B6FF8153376B097A1090E5C60A2A4E6931741DC1A66FB5C5F
File Size:
4.37 MB, 4366864 bytes
|
|
MD5:
743332c5817338609fbc4d5e85ee5c69
SHA1:
9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2
SHA256:
950A12ED22261F193E658329A21A50BBF0C33C5E527B7666EA2E17B1891FA92F
File Size:
4.48 MB, 4475181 bytes
|
|
MD5:
b031db0f8b1db79fe6c405c4c4a15a7a
SHA1:
2ed0d9d5c77b188ae4254e17b30e3a2e7b94bb94
SHA256:
7AD87C05FB6196021BD5F1FC73294A3616C9F81756F71FD0251E2344C52A4290
File Size:
4.89 MB, 4887552 bytes
|
|
MD5:
ab07c502166906dabb3ab7830265cf88
SHA1:
659274b793ae24658ee66a9659b177064073ff16
SHA256:
DF4FE51CAD23582702C2765FD1B584DFFAF1F8D8ED04EC8F5E1EF158C2CC607D
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
e9ed5082f672576cf4456cf083479493
SHA1:
c4f3ed149e838160a47b92fc6cc3f3358d4fb534
SHA256:
F9DEF0FB9669962E0BEA9604B54A95206DB83A94EA7163BCA0E1217400A6118D
File Size:
5.27 MB, 5268992 bytes
|
Show More
|
MD5:
683bd92f0f4002a2484cb0d6f1081134
SHA1:
c4ef5eef921b40ce3059add303a93e1798fc93b3
SHA256:
8DD03795B3FB1EA766DB8F3B3AD57D6F2B53C6CF1118E50BCC8D0652D71E24DF
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
cfc4d8fbc2824a64d40999e4c5781759
SHA1:
22f3eb5e28aadc83e9f81af9df3d4969b658fce0
SHA256:
775AF6E2DFB604BB7C788327B75A22F566157E6F4A6364632CE85FFFA607AE67
File Size:
4.89 MB, 4887552 bytes
|
|
MD5:
8c5c4eb4a60a53b8c0a2b91574ea63f7
SHA1:
3c99835aa1f85660192b622d49c0aaebfd1430e8
SHA256:
3C63DC60492203A8F65CCD04DC94D912C3F6783FB676136238B83E3A0787E306
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
d838ef4aaa462180fd51173cd45a46be
SHA1:
ff371f449db384ab6b49426e9ae64f41f1b5d692
SHA256:
9C100F9F26EB495DADD490650D3EBCC8BD6BDBC9A534A3CEB40B01B051422106
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
75d38680019299cf7a828fd28ffccbc1
SHA1:
37d9efe70dbad097e0164420c19999241939cf73
SHA256:
0AA9283D20F3ABD4C50B205A2C2F0F33A4D889465D5381C8DD6E90A730BE31C9
File Size:
3.55 MB, 3551063 bytes
|
|
MD5:
6d61db050931a6185e429fc672bff2c9
SHA1:
534b29a018828a1fa6606349ab0a9139c5077cc9
SHA256:
B69281DEA45F255A45E99FBBE6A0C89FC269C68B6448B04F1BDC560DEC70DE8E
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
10f7abd5fcb7e108dc1c0ae84d801c7b
SHA1:
bc63156d60f96eac24a3bc494ff170a3d2d05e5e
SHA256:
7BFA865FE98EBAABD9780046358F3FEB1B37142729F37F0909DFAD5ACAEDCA32
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
2e4173f119d4f6d936f69d5ec12a9acc
SHA1:
27db7d5a916503d7f034b0ec33c3f303ff6e6a83
SHA256:
66EC01FDFC7BA17FBD87E7C03821BD7E79AE6E7641182BA67082F2868AADFF35
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
f2268bfc231cf2cef0cb50a01bf8a8bb
SHA1:
9aadf79a25d20ccc38b45f7f9651352c6c1aefa7
SHA256:
4020F25C4ACF1FF39D9F894CD72B81111BD8DB32F467B8C2B6EADCC0F0E32790
File Size:
4.72 MB, 4723248 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name | rmm.exe |
| Legal Copyright |
|
| Original File Name | tacticalrmm.exe |
| Original Filename | installer.go |
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- golang
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
- ntdll
- VirtualQueryEx
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- BestaFera.G
- BlackLock.A
- CobaltStrike.DWA
- CobaltStrike.XAD
- CobaltStrike.XM
Show More
- CobaltStrike.XN
- CobaltStrike.XV
- CobaltStrike.XZ
- Delf.DA
- Filecoder.DDC
- Filecoder.GOA
- Go.Agent.E
- Go.Rozena.A
- Goshell.C
- Goshell.F
- Ousaban.V
- ReverseShell.GA
- Rozena.EA
- TIYWEPXB.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\programdata\tacticalrmm\tacticalagent-v2.10.0-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.4.4-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.4.6-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.6.1-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.8.0-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.9.1-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-1anae.tmp\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-c9mev.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-go47v.tmp\0eceeb987206961b61e4979383a24f32d24171f0_0004366864.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-k9f5m.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\is-n0e21.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-o8lu0.tmp\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\setup log 2025-09-15 #001.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\setup log 2026-04-21 #001.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ܴ♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 똮♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 蠏♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䤷♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 胇♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 莵髵퇻ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᧅ鮎퇻ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| User Data Access |
|
| Syscall Use |
Show More
81 additional items are not displayed above. |
| Anti Debug |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Icmp |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Jrmtgdwl\AppData\Local\Temp\is-GO47V.tmp\0eceeb987206961b61e4979383a24f32d24171f0_0004366864.tmp" /SL5="$1026A,3528895,825344,c:\users\user\downloads\0eceeb987206961b61e4979383a24f32d24171f0_0004366864"
|
"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
|
C:\WINDOWS\system32\PING.EXE ping 127.0.0.1 -n 2
|
C:\WINDOWS\system32\net.exe net stop tacticalrpc
|
WriteConsole: Access is denied
|
Show More
"cmd.exe" /c net stop tacticalagent
|
C:\WINDOWS\system32\net.exe net stop tacticalagent
|
WriteConsole: Access is denied
|
"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
|
C:\WINDOWS\system32\PING.EXE ping 127.0.0.1 -n 2
|
C:\WINDOWS\system32\net.exe net stop tacticalrmm
|
WriteConsole: Access is denied
|
"cmd.exe" /c taskkill /F /IM tacticalrmm.exe
|
C:\WINDOWS\system32\taskkill.exe taskkill /F /IM tacticalrmm.exe
|
WriteConsole: ERROR: CoInitial
|
"cmd.exe" /c sc delete tacticalagent
|
C:\WINDOWS\system32\sc.exe sc delete tacticalagent
|
WriteConsole: [SC] OpenService
|
"cmd.exe" /c sc delete tacticalrpc
|
C:\WINDOWS\system32\sc.exe sc delete tacticalrpc
|
WriteConsole: [SC] OpenService
|
"C:\Users\Tqxwwhoq\AppData\Local\Temp\is-1ANAE.tmp\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181.tmp" /SL5="$6004A,3636643,825344,c:\users\user\downloads\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181"
|
"C:\Users\Xowgraho\AppData\Local\Temp\is-O8LU0.tmp\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248.tmp" /SL5="$E0040,3722619,861184,c:\users\user\downloads\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248"
|
WriteConsole: ERROR: The proce
|
