General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware2.12327.21021

  • Size

    715KB

  • Sample

    220808-f8wh3adhen

  • MD5

    c80d2f3ca48ab6ca2ae98951793a91ea

  • SHA1

    54980a3ecf2d00cd583a0b496035c5d0df5ea00c

  • SHA256

    0f94dbc5795808376e1f58af647fe522762836503be7c601a76a59b538f8e9f1

  • SHA512

    6c2ba097d7cbfff3a9276ff0fd4ce8b5e13447ab72568e5a1c99f2cc950722b5de42160c2c866f42bfac32f1332fdba8c6db02cfa8f873a26dd6d919bca2b83e

Malware Config

Extracted

Family

remcos

Botnet

Finally

C2

185.62.86.145:42024

Attributes
audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
onedrivee
mouse_option
false
mutex
onedrive-TYU0OA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

    • Target

      SecuriteInfo.com.W32.AIDetect.malware2.12327.21021

    • Size

      715KB

    • MD5

      c80d2f3ca48ab6ca2ae98951793a91ea

    • SHA1

      54980a3ecf2d00cd583a0b496035c5d0df5ea00c

    • SHA256

      0f94dbc5795808376e1f58af647fe522762836503be7c601a76a59b538f8e9f1

    • SHA512

      6c2ba097d7cbfff3a9276ff0fd4ce8b5e13447ab72568e5a1c99f2cc950722b5de42160c2c866f42bfac32f1332fdba8c6db02cfa8f873a26dd6d919bca2b83e

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Adds Run key to start application

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Privilege Escalation