Overview

overview

10

Static

static

GGGJKJHT.exe

windows7-x64

10

GGGJKJHT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1756E68ED77EB46C9B9B99B8C29F3E1ABAEEA962BAB576D608BB8BB12D5E7661

  • Size

    1.2MB

  • Sample

    221123-r2pygsab76

  • MD5

    8b39d0dce4a21ee5ad336a1ae0a30613

  • SHA1

    ef5617a17dfbd004000c6595353a67f8b6cd1af5

  • SHA256

    1756e68ed77eb46c9b9b99b8c29f3e1abaeea962bab576d608bb8bb12d5e7661

  • SHA512

    bc91f572c86da3d40592332987b8266c85323cbd43e503c620481246461babf9f93d9247303accbb49adc8eb99e74573c8e9f225d89fedfa06af1e7c69223ee0

  • SSDEEP

    12288:hG4/BDSD2PBTRhfPF7tlY9R0ivqJypAfdiELESzoYpJv6Ci/w28:BQD2PBTRdN74givqJCAfdT9zcN

Score
10/10
remcosawarat

Malware Config

Extracted

Family

remcos

Botnet

awa

C2

gdyhjjdhbvxgsfe.gotdns.ch:2718

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-J6C5A7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      GGGJKJHT.EXE

    • Size

      615KB

    • MD5

      d3af78d340e8eaa3bcf1142bdbb14c37

    • SHA1

      a0df46e917ec4333a331ec0fcb0f2ab421bfb86a

    • SHA256

      a70cc2556566f9b13f61f227b1c9612e26dec4d92fc879f25b56801385ca5217

    • SHA512

      da532459118b844a75ed9deae460293b2b5ec2a8f64f9319e57bf2cf2b8110ec7ddcc599459a1807a2332f20196a39240f965692bc85c04ea6a2cac68c43e42b

    • SSDEEP

      12288:LG4/BDSD2PBTRhfPF7tlY9R0ivqJypAfdiELESzoYpJv6Ci/w28:jQD2PBTRdN74givqJCAfdT9zcN

    Score
    10/10
    remcosawarat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks