Overview

overview

10

Static

static

4

2ef1aedbfa...a7.exe

windows7_x64

10

2ef1aedbfa...a7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ef1aedbfa1d92513e8a45015b59cdd649eb7aac25e420b18c5d564c30066ea7.zip

  • Size

    1.7MB

  • Sample

    210414-endas8ebta

  • MD5

    82b480305f0c36eb7d7e72f00125bb82

  • SHA1

    9af3302581d53e0eafd60c5f56cf3bac2198ab16

  • SHA256

    9273e6c9157cc1846b6b236bc59914161ec91fdfdfe1979090bfabdf0ad06543

  • SHA512

    026b8a61286b1d0913be87fa9807a11b2c31f55c806ce011e17d3352da97ef212032b2bec45ec7acc4f4d8c5b09457754b86b0718ef5c07cf7fdaee6b4d4b985

Score
10/10
remcoswebmonitorbackdoorinfostealerlinkpdfpersistenceratupx

Malware Config

Extracted

Family

remcos

C2

daya4659.ddns.net:8282

Targets

    • Target

      2ef1aedbfa1d92513e8a45015b59cdd649eb7aac25e420b18c5d564c30066ea7

    • Size

      2.9MB

    • MD5

      21948d42c2c1e49cadea88e80dfe6880

    • SHA1

      d7f6837f76f3785eef87048c4a28c4b664f99dbd

    • SHA256

      2ef1aedbfa1d92513e8a45015b59cdd649eb7aac25e420b18c5d564c30066ea7

    • SHA512

      14054453d259e53d88881a6b50061960befc06309fc14d1f557d5cb3cbc2ac7e855a805cc483915e8b5ce737c328dd03a8cfbc9a68a670e0238896009befa863

    Score
    10/10
    remcoslinkpdfpersistenceratwebmonitorbackdoorinfostealerupx

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks