Overview

overview

10

Static

static

PAYMENT_.exe

windows7-x64

10

PAYMENT_.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_Notification3.pdf.iso

  • Size

    1.2MB

  • Sample

    221202-tx4xyshe7x

  • MD5

    6b035b0de1108bc9c8c7b69c482b069c

  • SHA1

    fe36c08dc077d0e788f83dc1826390aebfb159d0

  • SHA256

    798dbad3b5e2f7c0a699c317e81197bf4daa027c03d50c67c2765d8e125d5025

  • SHA512

    cc4f6c0939b69f0e657e1fdef4d7c5305b0a4889ec216c1369ae249c659fc0a8b8142ce7a2d50f9ff41380ca5a42ff4b0d7a65a2d9df8e34b1755915eaa75c35

  • SSDEEP

    12288:13DSfd7aiEAfcGZonHajdaRARTUDso5i6D090q8w4KVPfw0e9G3i3o:13DSlailsn6JaP5c0qf

Score
10/10
agentteslaremcosremotehostcollectionkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

top.thekillforabuse1.xyz:55988

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-3LSD40

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PAYMENT_.EXE

    • Size

      576KB

    • MD5

      d1e74b7df92ddadd2370e62d2b02687f

    • SHA1

      67c2de5fb75f59af0c9005d2d9feebb2464df8cd

    • SHA256

      b05858be9cfce1e5405b340dd3f80eed01ee77058b9c7af49ca7dd4108f771d1

    • SHA512

      a0a22f3fcc8517138b01995d61de19b881ec588b40b7738a36edcabd336542a145496720fa0ffe6ca99749c31e166c6808b04ec4b7f53e0e9a5733aadbbe13f8

    • SSDEEP

      12288:+3DSfd7aiEAfcGZonHajdaRARTUDso5i6D090q8w4KVPfw0e9G3i3o:+3DSlailsn6JaP5c0qf

    Score
    10/10
    remcosremotehostratagentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Drops startup file

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks