Overview

overview

10

Static

static

Payment_No...df.exe

windows7-x64

10

Payment_No...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_Notification3.pdf.exe

  • Size

    576KB

  • Sample

    221202-lkpy9sdd85

  • MD5

    d1e74b7df92ddadd2370e62d2b02687f

  • SHA1

    67c2de5fb75f59af0c9005d2d9feebb2464df8cd

  • SHA256

    b05858be9cfce1e5405b340dd3f80eed01ee77058b9c7af49ca7dd4108f771d1

  • SHA512

    a0a22f3fcc8517138b01995d61de19b881ec588b40b7738a36edcabd336542a145496720fa0ffe6ca99749c31e166c6808b04ec4b7f53e0e9a5733aadbbe13f8

  • SSDEEP

    12288:+3DSfd7aiEAfcGZonHajdaRARTUDso5i6D090q8w4KVPfw0e9G3i3o:+3DSlailsn6JaP5c0qf

Score
10/10
agentteslaremcosremotehostcollectionkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

top.thekillforabuse1.xyz:55988

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-3LSD40

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Payment_Notification3.pdf.exe

    • Size

      576KB

    • MD5

      d1e74b7df92ddadd2370e62d2b02687f

    • SHA1

      67c2de5fb75f59af0c9005d2d9feebb2464df8cd

    • SHA256

      b05858be9cfce1e5405b340dd3f80eed01ee77058b9c7af49ca7dd4108f771d1

    • SHA512

      a0a22f3fcc8517138b01995d61de19b881ec588b40b7738a36edcabd336542a145496720fa0ffe6ca99749c31e166c6808b04ec4b7f53e0e9a5733aadbbe13f8

    • SSDEEP

      12288:+3DSfd7aiEAfcGZonHajdaRARTUDso5i6D090q8w4KVPfw0e9G3i3o:+3DSlailsn6JaP5c0qf

    Score
    10/10
    agentteslaremcosremotehostcollectionkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks