General

  • Target
    G014 & G015 SPEC SHEET.exe
  • Size 148KB
  • Sample210329-bwwdjqzrt2
  • SHA256 3a80ad81bdfbf133bb92fca5ca32477d0079be2bf26872819fd29d81bfaaf1c2
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • remcos

C2
  • thankgodwell.ddns.net:9875

Targets

    • Target
      G014 & G015 SPEC SHEET.exe
    • Size 148KB
    • SHA256 3a80ad81bdfbf133bb92fca5ca32477d0079be2bf26872819fd29d81bfaaf1c2
    • MD5 SHA1 SHA512
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks