Overview

overview

10

Static

static

libcrypto-1_1.sfx.exe

windows7_x64

10

libcrypto-1_1.sfx.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    libcrypto-1_1.sfx.exe

  • Size

    1.9MB

  • Sample

    210112-w65lrxb3qs

  • MD5

    ef39ea0b41b06ea6c8ea7259e538f2d0

  • SHA1

    2f2cb13dbeb72a8e946c7aa0c8f1fc59b06ab196

  • SHA256

    0fa5f308271acceabd13e15871b230e030550825e17bdd0b3b1e53724ca5abd6

  • SHA512

    4e349e98bda41fa0c3e2f6bedeef194d790548dd748ae746bfe06ef0dffe29a4df2a72e3372825896ce4c465a181752fa41b5b8ec1962748bbb5f1fdf85d4b80

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

5.45.87.29:8000

Targets

    • Target

      libcrypto-1_1.sfx.exe

    • Size

      1.9MB

    • MD5

      ef39ea0b41b06ea6c8ea7259e538f2d0

    • SHA1

      2f2cb13dbeb72a8e946c7aa0c8f1fc59b06ab196

    • SHA256

      0fa5f308271acceabd13e15871b230e030550825e17bdd0b3b1e53724ca5abd6

    • SHA512

      4e349e98bda41fa0c3e2f6bedeef194d790548dd748ae746bfe06ef0dffe29a4df2a72e3372825896ce4c465a181752fa41b5b8ec1962748bbb5f1fdf85d4b80

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks