General

  • Target

    99da8843bd007d2487d2251d6f62007ca6ee50884e2f54c13aae98a23b35e8ec

  • Size

    1.1MB

  • Sample

    220121-3ljx3sdbe2

  • MD5

    9f56eea3d0b23e1e3cf30ea12008a33e

  • SHA1

    812a407516f9712c80b70a14d6cdf282c88938c1

  • SHA256

    99da8843bd007d2487d2251d6f62007ca6ee50884e2f54c13aae98a23b35e8ec

  • SHA512

    b552d1c7ddd1a778fc438ad27fa79cbbafc83ccf35ac60663410dd099a848c7f7b703b73399a8626300264327fbb865353a923d6a86dd3d9e377ab226ef7f332

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

zzzzzzzzzzzzZZZZZZZZZZZZZZZZMORNINGSTAR

C2

dominoduck2098.duckdns.org:9599

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Chrome.exe

  • copy_folder

    Chrome

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    system

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-ZUH30K

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      99da8843bd007d2487d2251d6f62007ca6ee50884e2f54c13aae98a23b35e8ec

    • Size

      1.1MB

    • MD5

      9f56eea3d0b23e1e3cf30ea12008a33e

    • SHA1

      812a407516f9712c80b70a14d6cdf282c88938c1

    • SHA256

      99da8843bd007d2487d2251d6f62007ca6ee50884e2f54c13aae98a23b35e8ec

    • SHA512

      b552d1c7ddd1a778fc438ad27fa79cbbafc83ccf35ac60663410dd099a848c7f7b703b73399a8626300264327fbb865353a923d6a86dd3d9e377ab226ef7f332

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks