remcos | d6ee6bb4bf80fe883da0a277b1f1f12fb40c00d4893cfff05060b1ebf4a5ca96 | Triage

Sharing

General

Target

NEW INQUIRY 0220.PDF.exe
Size

1.2MB
Sample

221102-qtp3vahbc7
MD5

2d05551d7c9aaac7e920d42fa0f209f7
SHA1

a79a4d1842a44a53527192c961f653dd73973760
SHA256

d6ee6bb4bf80fe883da0a277b1f1f12fb40c00d4893cfff05060b1ebf4a5ca96
SHA512

163e41c904794f0b3cff738472dc2787f792062c7b12b7a0802fd0cd4a7dc6712fdcb1cebd4527f10f66ea746062b99e1b810b65671cabe6bcf6702bd345bc32
SSDEEP

24576:eWmdxkr5uJJs7e2mAJZQd8tpOupzRQGL3dRhFWuyKHivAQ43:en+r5uzsS2VZbtDDThFWuyKOAQ4

Score

10^/10

remcos new rem stub rat

Malware Config

Extracted

Family

remcos

Botnet

NEW REM STUB

C2

valvesco.duckdns.org:5050

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-48V73L
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  NEW INQUIRY 0220.PDF.exe
- Size
  
  1.2MB
- MD5
  
  2d05551d7c9aaac7e920d42fa0f209f7
- SHA1
  
  a79a4d1842a44a53527192c961f653dd73973760
- SHA256
  
  d6ee6bb4bf80fe883da0a277b1f1f12fb40c00d4893cfff05060b1ebf4a5ca96
- SHA512
  
  163e41c904794f0b3cff738472dc2787f792062c7b12b7a0802fd0cd4a7dc6712fdcb1cebd4527f10f66ea746062b99e1b810b65671cabe6bcf6702bd345bc32
- SSDEEP
  
  24576:eWmdxkr5uJJs7e2mAJZQd8tpOupzRQGL3dRhFWuyKHivAQ43:en+r5uzsS2VZbtDDThFWuyKOAQ4
Score

10^/10

remcos new rem stub rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

remcosnew rem stubrat

behavioral2

remcosnew rem stubrat