General

  • Target

    7835496120.zip

  • Size

    566KB

  • Sample

    220808-yb7tyahca8

  • MD5

    138390071ca53b26e747d4d194bc12c8

  • SHA1

    79813aa24b3cfef626efcf6689d06a60afddc296

  • SHA256

    3c59c1ddd7cf7cce9efe10d099a8551af818dee19bde52b46e0fbfb0c50fc136

  • SHA512

    dec383dff031b78444c29d121e416faefb656f617ae3944e4f223b416b8538302be31e6fc9572697b4ea2bce6b891950bdb9b98af27af1d7581fc554d7d2d47b

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.varshtrade.com:2404

Attributes
audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
notepad
mouse_option
false
mutex
notepad-TFQMB3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

    • Target

      c1fb3c03cd371463107058c6c2b3a23b234578fd7df330d85efce4c85bcee570

    • Size

      1MB

    • MD5

      a2a39d65f598684ac9bdb3a88d85d670

    • SHA1

      81ae837a631e65953b246b75959873e16c91204b

    • SHA256

      c1fb3c03cd371463107058c6c2b3a23b234578fd7df330d85efce4c85bcee570

    • SHA512

      848f6ff70d0d95febd4118dc3a499563274be860b3ca2e210d5d6db16a9be3c7fad9e8a0b65f52634827f1799f024958e4ad55c184ed5f062808c0d59f3bac3f

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation