Overview

overview

10

Static

static

10

RariCapita....1.exe

windows7_x64

10

RariCapita....1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RariCapital-Market-App-v2.1.1.exe

  • Size

    119.7MB

  • Sample

    220218-g9z4babga4

  • MD5

    66cf17cef0fa02c78363850fa888017b

  • SHA1

    255735f0107fd4c101e7f53820f78d0889cd4bc4

  • SHA256

    c4c4907ba3a60d331c7bfa836babe276a4166a889ca734a3f40916ace8a80f9d

  • SHA512

    f14e074aad2a5c7db1e5256f73cad0c27199eb3eb60c2f9040336996717fa7c6456015c1995a04f61fb436b192eb86580b452acb7cf18d5c1520afc46305bd15

Score
10/10
babadedaremcossys32crypterloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

C2

157.90.1.54:4783

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Logs

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Sys-CZ7MI0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      RariCapital-Market-App-v2.1.1.exe

    • Size

      119.7MB

    • MD5

      66cf17cef0fa02c78363850fa888017b

    • SHA1

      255735f0107fd4c101e7f53820f78d0889cd4bc4

    • SHA256

      c4c4907ba3a60d331c7bfa836babe276a4166a889ca734a3f40916ace8a80f9d

    • SHA512

      f14e074aad2a5c7db1e5256f73cad0c27199eb3eb60c2f9040336996717fa7c6456015c1995a04f61fb436b192eb86580b452acb7cf18d5c1520afc46305bd15

    Score
    10/10
    babadedaremcossys32crypterloaderpersistencerat

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks