General

  • Target

    Attached pdf.exe

  • Size

    617KB

  • Sample

    210330-x7l24elz72

  • MD5

    83c9cee1f209ec02934e3895d5c51dfa

  • SHA1

    2ba1dac5e2fef7a948b21efcc267b3096656cf68

  • SHA256

    93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee

  • SHA512

    2df5a3c0f01f3aed5dd1d1cee3ef30e99b0b7e5e1692c6818f720d6d00bcb2b23a56b2334422ae618a57ffe87ceab0c5b54d6d43bfd463e77956eaa3feb656a2

Malware Config

Extracted

Family

remcos

C2

rem1.camdvr.org:2404

rem16.hopto.org:2404

rem1666.hopto.org:2404

rem16.camdvr.org:2404

remmusic.freeddns.org:2404

sunwap1.ddns.net:2404

Targets

    • Target

      Attached pdf.exe

    • Size

      617KB

    • MD5

      83c9cee1f209ec02934e3895d5c51dfa

    • SHA1

      2ba1dac5e2fef7a948b21efcc267b3096656cf68

    • SHA256

      93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee

    • SHA512

      2df5a3c0f01f3aed5dd1d1cee3ef30e99b0b7e5e1692c6818f720d6d00bcb2b23a56b2334422ae618a57ffe87ceab0c5b54d6d43bfd463e77956eaa3feb656a2

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks