e30b26ce154af3e9e743c557dfe49071

General
Target

e30b26ce154af3e9e743c557dfe49071

Size

832KB

Sample

210915-hqya2saad2

Score
10 /10
MD5

e30b26ce154af3e9e743c557dfe49071

SHA1

d38122696b55c3121e9d58d8cbdd2b3400dba610

SHA256

da518c888f3041f6b13de0f7c54ac9429efa87a8c78fd426f81bd45d8dc66d8e

SHA512

be977eb665ffdcc468776e4c28983cded2390d29c8bf0c4f1db1744754caeeff08d4ec52712d71d306e8ac28df74e3c5e70232d1909556609ee6c427bc3758e4

Malware Config

Extracted

Family remcos
Version 3.2.0 Pro
Botnet Sys32
C2

135.181.140.182:4783

Attributes
audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
SYS32-S57R8C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;
Targets
Target

e30b26ce154af3e9e743c557dfe49071

MD5

e30b26ce154af3e9e743c557dfe49071

Filesize

832KB

Score
10 /10
SHA1

d38122696b55c3121e9d58d8cbdd2b3400dba610

SHA256

da518c888f3041f6b13de0f7c54ac9429efa87a8c78fd426f81bd45d8dc66d8e

SHA512

be977eb665ffdcc468776e4c28983cded2390d29c8bf0c4f1db1744754caeeff08d4ec52712d71d306e8ac28df74e3c5e70232d1909556609ee6c427bc3758e4

Tags

Signatures

  • Remcos

    Description

    Remcos is a closed-source remote control and surveillance software.

    Tags

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          1/10

                          behavioral2

                          10/10