General

  • Target

    0fbf740aa0063a260f0ec51d624d35f66d4aa2703076789a8e6f421acdc58082

  • Size

    7.8MB

  • Sample

    220605-kprszshdg2

  • MD5

    9b3981501bcd000aa7cd40543da7cd5d

  • SHA1

    52fb5fb68e834884751fad1594ee47188e4403af

  • SHA256

    0fbf740aa0063a260f0ec51d624d35f66d4aa2703076789a8e6f421acdc58082

  • SHA512

    aaca5b77d3ef4e2489f94caccc331b4b2cfe5d5fefa02fdf113a44e014e28888b4e89e4bd6b8215fe965f081d1afe99f436cf22a06855fdf6416a94806213dea

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

giga10

C2

CEDSXoissLv2NiM.club:5762

PgqduOYXVZeNNam.xyz:5762

USd7O88wEMlUtX5.xyz:5762

pMfiryhhkiN98Px.xyz:5762

Se2Qwz60L2OxZNM.xyz:5762

GWtY0fiG58DCq6F.xyz:5762

maui16azsncpo97.info:5762

mj99puoba6c3gun.info:5762

tu90to3b4q4uqze.info:5762

cwt1u0vv8ic357ov.info:5762

agaoajz1hrvevre.info:5762

poykoqnl7jkj632.info:5762

cbiq1neygyp1wno.info:5762

BCBNcQ393Z3HPLQ.club:5762

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-UQ8E24

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      0fbf740aa0063a260f0ec51d624d35f66d4aa2703076789a8e6f421acdc58082

    • Size

      7.8MB

    • MD5

      9b3981501bcd000aa7cd40543da7cd5d

    • SHA1

      52fb5fb68e834884751fad1594ee47188e4403af

    • SHA256

      0fbf740aa0063a260f0ec51d624d35f66d4aa2703076789a8e6f421acdc58082

    • SHA512

      aaca5b77d3ef4e2489f94caccc331b4b2cfe5d5fefa02fdf113a44e014e28888b4e89e4bd6b8215fe965f081d1afe99f436cf22a06855fdf6416a94806213dea

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks