Overview

overview

10

Static

static

4

99d258fb84...b7.exe

windows7_x64

10

99d258fb84...b7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99d258fb84b82382de0faa36e57a0bb13eb7c107098ab06c64d88cbf1b8e2db7

  • Size

    2.9MB

  • Sample

    210508-7994x72see

  • MD5

    14e8869c598322275ae390eb2e6f36af

  • SHA1

    e904d47a554aea9ea53d85eeaf1d9bac939e9e09

  • SHA256

    99d258fb84b82382de0faa36e57a0bb13eb7c107098ab06c64d88cbf1b8e2db7

  • SHA512

    a7017b5be156634afdf218e2b2b50633ba2b27492ddce9fa07bca1ed8237fa981667596a4777864cf475858ab0885f257819bacfe94d321293f6cce6c790d3ff

Score
10/10
remcoswebmonitorbackdoorinfostealerlinkpdfpersistenceratupx

Malware Config

Extracted

Family

remcos

C2

daya4659.ddns.net:8282

Targets

    • Target

      99d258fb84b82382de0faa36e57a0bb13eb7c107098ab06c64d88cbf1b8e2db7

    • Size

      2.9MB

    • MD5

      14e8869c598322275ae390eb2e6f36af

    • SHA1

      e904d47a554aea9ea53d85eeaf1d9bac939e9e09

    • SHA256

      99d258fb84b82382de0faa36e57a0bb13eb7c107098ab06c64d88cbf1b8e2db7

    • SHA512

      a7017b5be156634afdf218e2b2b50633ba2b27492ddce9fa07bca1ed8237fa981667596a4777864cf475858ab0885f257819bacfe94d321293f6cce6c790d3ff

    Score
    10/10
    remcoslinkpdfpersistenceratupxwebmonitorbackdoorinfostealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks