Overview

overview

10

Static

static

Angebotsan...df.exe

windows7_x64

6

Angebotsan...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Angebotsanfrage - Order-00132E,pdf.exe

  • Size

    1020KB

  • Sample

    210813-ylfs3fywe6

  • MD5

    4cbc5df423aca14b9102340af4f3defc

  • SHA1

    bbcd8057225afc8f1c68fa5670da07c8187b9b34

  • SHA256

    8d076437949873b971f9534e630ebe26a8437f50786c430eaeb46c71d53a88e5

  • SHA512

    6859bb6f60a5af6ffa8ba94dad41499cda9405e3a3e133040be3bf0591cb5d67e5f47f3455c4f40b9517563e78c0cedf794fb01523d1a50a60e50e49616bb37b

Score
10/10
remcoslas laspersistencerat

Malware Config

Extracted

Family

remcos

Botnet

LAS LAS

C2

goddywin.freedynamicdns.net:4108

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-YZ590Y

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      Angebotsanfrage - Order-00132E,pdf.exe

    • Size

      1020KB

    • MD5

      4cbc5df423aca14b9102340af4f3defc

    • SHA1

      bbcd8057225afc8f1c68fa5670da07c8187b9b34

    • SHA256

      8d076437949873b971f9534e630ebe26a8437f50786c430eaeb46c71d53a88e5

    • SHA512

      6859bb6f60a5af6ffa8ba94dad41499cda9405e3a3e133040be3bf0591cb5d67e5f47f3455c4f40b9517563e78c0cedf794fb01523d1a50a60e50e49616bb37b

    Score
    10/10
    persistenceremcoslas lasrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks