General

  • Target

    9313c0c70b2ed14b8a335c5a77669f18db08791f72ccc8b7edb7a08a073c1c34

  • Size

    674KB

  • Sample

    220122-bymqysghh8

  • MD5

    ad8abb347d8586b0d6abf1614dc489d2

  • SHA1

    5230bc297b8ee93472a8bd0849d75b22639cb24b

  • SHA256

    9313c0c70b2ed14b8a335c5a77669f18db08791f72ccc8b7edb7a08a073c1c34

  • SHA512

    75046b1ad26d13aac3663db882d0f1af70c3f464d53e40270f807703d3151791dd8514644d90cea6833faee9b2d2712089fbed904c56bcd5a1700811130f8f85

Score
10/10

Malware Config

Extracted

Family

remcos

Version

1.8.2 Pro

Botnet

Host

C2

casillas.hicam.net:2404

casillasmx.chickenkiller.com:2404

casillas45.hopto.org:2404

casillas.libfoobar.so:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    casillas-RL8G2N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

Targets

    • Target

      9313c0c70b2ed14b8a335c5a77669f18db08791f72ccc8b7edb7a08a073c1c34

    • Size

      674KB

    • MD5

      ad8abb347d8586b0d6abf1614dc489d2

    • SHA1

      5230bc297b8ee93472a8bd0849d75b22639cb24b

    • SHA256

      9313c0c70b2ed14b8a335c5a77669f18db08791f72ccc8b7edb7a08a073c1c34

    • SHA512

      75046b1ad26d13aac3663db882d0f1af70c3f464d53e40270f807703d3151791dd8514644d90cea6833faee9b2d2712089fbed904c56bcd5a1700811130f8f85

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Discovery

System Information Discovery

1
T1082

Tasks