Overview

overview

10

Static

static

ae1d75a5f8...65.exe

windows7_x64

10

ae1d75a5f8...65.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae1d75a5f87421953372e79c081e4b0a929f65841ed5ea0d380b6289e4a6b565

  • Size

    334KB

  • Sample

    220128-xlrd9sbcg4

  • MD5

    67fff57bb44d3458b17f0c7a7a45f405

  • SHA1

    08b89a6e2d61239b98235c61a61252254dea91d8

  • SHA256

    ae1d75a5f87421953372e79c081e4b0a929f65841ed5ea0d380b6289e4a6b565

  • SHA512

    f659c975fab72e952ca02ec88eead0decdae87ab29f9e1cafe25ff2fd272bfd801e8225554b6ec79b4a7c5f87a40905f85ccc5248db2b8857014be7d30c71450

Score
10/10
remcoshostpersistencerat

Malware Config

Extracted

Family

remcos

Version

1.8.1 Pro

Botnet

Host

C2

remserver.ddns.net:80

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    32

  • connect_interval

    120

  • copy_file

    MsUpdate.exe

  • copy_folder

    MsUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    MSLogs

  • keylog_path

    %AppData%

  • mouse_option

    true

  • mutex

    ftgBhyI^--jj%9*520.[]?/-2QGBNB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    MsScreens

  • screenshot_path

    %AppData%

  • screenshot_time

    5

  • startup_value

    MsUpdate

  • take_screenshot_option

    false

  • take_screenshot_time

    10

  • take_screenshot_title

    login;outlook;signin;military;skype;gmail;mail;inbox;

Targets

    • Target

      ae1d75a5f87421953372e79c081e4b0a929f65841ed5ea0d380b6289e4a6b565

    • Size

      334KB

    • MD5

      67fff57bb44d3458b17f0c7a7a45f405

    • SHA1

      08b89a6e2d61239b98235c61a61252254dea91d8

    • SHA256

      ae1d75a5f87421953372e79c081e4b0a929f65841ed5ea0d380b6289e4a6b565

    • SHA512

      f659c975fab72e952ca02ec88eead0decdae87ab29f9e1cafe25ff2fd272bfd801e8225554b6ec79b4a7c5f87a40905f85ccc5248db2b8857014be7d30c71450

    Score
    10/10
    remcoshostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks