General

  • Target

    0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

  • Size

    4.5MB

  • Sample

    220630-wgkkgsgfa5

  • MD5

    d73134c0b780595c6c95f8568c1f81a7

  • SHA1

    19bd711b9d66df0353f5d74ae9ef6c30909dba78

  • SHA256

    0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

  • SHA512

    e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

1

C2

193.111.198.220:5861

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Logs

  • keylog_path

    %Temp%

  • mouse_option

    false

  • mutex

    5850Port-UAYNLL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

    • Size

      4.5MB

    • MD5

      d73134c0b780595c6c95f8568c1f81a7

    • SHA1

      19bd711b9d66df0353f5d74ae9ef6c30909dba78

    • SHA256

      0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

    • SHA512

      e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks