Overview

overview

10

Static

static

2364933543...27.exe

windows7-x64

10

2364933543...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24-236493354378eefc6203b957baa7df24b566d8e5b0f04523bbb060999cc8a227.zip

  • Size

    824KB

  • Sample

    221012-syvv1ahefk

  • MD5

    4350ef4992be46206208d5eac246d64b

  • SHA1

    a9ac3586e3cd95433b9fbc64a374e93aaad39df0

  • SHA256

    d06d08803e73e37aff5ff3417a7d78d41dc98f8a10ca4da331b9919dafc92cab

  • SHA512

    3f4037b1a25dbdaf7ac46ff80c7c422956c78b56d345e2fe8f1baa9efe03215aeeff5c39f02d952eab922117dc8c52370a81a6534f5dd61fc1354ce21b7e60ac

  • SSDEEP

    24576:jYspI8vnQCZCAjwnfbpL6hEWUjqtSmghd:jYOtBwfblKEWUmtSmgj

Score
10/10
remcosip-remcosrat

Malware Config

Extracted

Family

remcos

Botnet

IP-REMCOS

C2

91.192.100.12:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-JS00ZN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      236493354378eefc6203b957baa7df24b566d8e5b0f04523bbb060999cc8a227.exe

    • Size

      1016KB

    • MD5

      87d248727141ea8053b5ded89750962b

    • SHA1

      654c2110cbe433f8697a2347e590d63a563c1f8b

    • SHA256

      236493354378eefc6203b957baa7df24b566d8e5b0f04523bbb060999cc8a227

    • SHA512

      aaee93e32842ae750414358b1b727764c968b8a8e3a8c0771b286df6e01b709583abd497d48189b047471271ea89f0517cb134022446ff93e184eda5a9f0cd61

    • SSDEEP

      12288:4ptk1UbDD5du/VAAiSdjXU4UZFGcVDmWsQaUUk3p82drYGBahHgGCUcZVpsNL:Mx5dAWCw4oIrrsp8WrYGFGCLbq

    Score
    10/10
    remcosip-remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks