General

  • Target

    7e4d028e324bf298477c6f864751b17e094b336ba13c2793db3f3b8545a4b765.zip

  • Size

    529KB

  • Sample

    221006-hq4g3agef6

  • MD5

    b3d22ba2946127054d58c9ee1ec1a421

  • SHA1

    6876af63cb4808d2ad292b5c95ab7a7ec15105ee

  • SHA256

    3baad6fa629146ccb1a68e6c611deec79480ef0168966ef64b1a66db826d4bbc

  • SHA512

    3a2f72880c76bd835a00306d845cdf5c62d1f510ed80062568f5e2f977f303385e5d843787226bb61160cc3f0f34b0c7d5665150c83f4a355127ba04b7379cd1

  • SSDEEP

    12288:6theHM8w/iZ722389zUIJd9CxS+F8Uf7Prlc:bHGQCB9DJaF/DzW

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

213.183.58.19:4000

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    read.dat

  • keylog_flag

    false

  • keylog_folder

    CastC

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_sccafsoidz

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      7e4d028e324bf298477c6f864751b17e094b336ba13c2793db3f3b8545a4b765.exe

    • Size

      1.0MB

    • MD5

      a18dd16dfc459dc879a4af1e0b707926

    • SHA1

      c02622680d618710d5be936e6206da2e30abf231

    • SHA256

      7e4d028e324bf298477c6f864751b17e094b336ba13c2793db3f3b8545a4b765

    • SHA512

      fd31d77f16e359506595be30051893be5206e8a31edc42b4dc31b3a9b0c64fb443b7ac9b9fe4ea52563d8d652e73a7da2e33a8cba586aebffa2751e733d0f8c9

    • SSDEEP

      24576:ZD39v74lfGQrFUspugRNJI2DJW//ojo/l:Zp7E+QrFUBgq2C

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks