remcos

General

Target
SecuriteInfo.com.CLASSIC.15436
Size 420KB
Sample201109-ed7d4hvzf2
SHA256 8a6bf2bc00a6d746dd60c82d00c5a226ffda03638cdcc937a0acb090363562ab
MD5 45c72f7b23e5eac4832d706b798b6b6e
SHA1 b05b0dc3385fe3f99f23c516dd53486f7f52be76
SHA512 f056742a28785c695f6425893f0dbf5236e603374e3608547cb33e8ed8eebe1fd8403c9a1298f62f4cbf7cf08484aa912f42fd7cb42ba9f00e0ff49449530340
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

eastsidepapi.myq-see.com:6996

Targets

- Target
  SecuriteInfo.com.CLASSIC.15436
- Size 420KB
- SHA256 8a6bf2bc00a6d746dd60c82d00c5a226ffda03638cdcc937a0acb090363562ab
- MD5 45c72f7b23e5eac4832d706b798b6b6e
- SHA1 b05b0dc3385fe3f99f23c516dd53486f7f52be76
- SHA512 f056742a28785c695f6425893f0dbf5236e603374e3608547cb33e8ed8eebe1fd8403c9a1298f62f4cbf7cf08484aa912f42fd7cb42ba9f00e0ff49449530340
- MD5 SHA1 SHA512
Score

10^/10

remcos agilenet persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

ServiceHost packer

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2