Overview

overview

10

Static

static

HOH76746.js

windows7_x64

10

HOH76746.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HOH76746.rar

  • Size

    410KB

  • Sample

    210819-ts5g8btnms

  • MD5

    c6e65fa1628505e8d20b56d2084210fd

  • SHA1

    3e97917a9fefc58172db88218273f409257e814b

  • SHA256

    5118bcfda155a19a27cfafea90a66f11624a11b8abcf00b300d544da0b73aea9

  • SHA512

    1e53a3693cba67b780a2b0e4d622e59cad79d5c2a710de5b5f956c7b441ad09aa25a9de124ea9957d009275e8ae55e8088577c897f592be8a2399f6530d57358

Score
10/10
remcosvjw0rm250millionpersistencerattrojanworm

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

250million

C2

www.ommi-it.com:8760

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    250million-2CWGNX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      HOH76746.js

    • Size

      1.7MB

    • MD5

      e261e68bcae0c10642170416082702b7

    • SHA1

      6c9b48b65090ec13326a07bef72b1c3995f72513

    • SHA256

      f126bcd906ba8815594cd987e4ba8852bccd58d813ac415a626e66ab5a395db2

    • SHA512

      05979d43fee175648476accc5562a02c9736337e21ca850ce893791365f5b54f55f9b6813cc0a20d2781ba09c16b6425ee01cb853ab546e049bc1e7e03dd8818

    Score
    10/10
    remcosvjw0rm250millionpersistencerattrojanworm

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks