Overview

overview

10

Static

static

591f8f7f1f...ae.exe

windows7-x64

10

591f8f7f1f...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    591f8f7f1f6fd6a7f723bdc73253fcae.exe

  • Size

    2MB

  • Sample

    221205-lrm39agc59

  • MD5

    591f8f7f1f6fd6a7f723bdc73253fcae

  • SHA1

    368fe6569d723c0b54a63a0c308cd648f35bdcc1

  • SHA256

    3b6f13caf1fff58da3a4ba290b6d7f2f4ef496517b0adc066137dc97e2ac7457

  • SHA512

    a474d88a3139ea5205f6a02a5a91780da8c4ec27d6f287f72feae0dd5e486989a1b73fad58d4f1364c6dc244ff2ca2801bcd459ee5042a9ea080cec50334ae0c

  • SSDEEP

    49152:XHmN3mosk90948L+g+ok5tAQXhcqb8pdEDzyjHr2IvMAzlTu2Qidl5pBax:XHw3XsL+g+zAQfZiLtvMAzJuepBa

Score
10/10
remcosmercycollectionratspywarestealer

Malware Config

Extracted

Family

remcos
Botnet

mercy
C2

mazhararyousaf.ddns.net:52046
Attributes
audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-C3LYJ6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

    • Target

      591f8f7f1f6fd6a7f723bdc73253fcae.exe

    • Size

      2MB

    • MD5

      591f8f7f1f6fd6a7f723bdc73253fcae

    • SHA1

      368fe6569d723c0b54a63a0c308cd648f35bdcc1

    • SHA256

      3b6f13caf1fff58da3a4ba290b6d7f2f4ef496517b0adc066137dc97e2ac7457

    • SHA512

      a474d88a3139ea5205f6a02a5a91780da8c4ec27d6f287f72feae0dd5e486989a1b73fad58d4f1364c6dc244ff2ca2801bcd459ee5042a9ea080cec50334ae0c

    • SSDEEP

      49152:XHmN3mosk90948L+g+ok5tAQXhcqb8pdEDzyjHr2IvMAzlTu2Qidl5pBax:XHw3XsL+g+zAQfZiLtvMAzJuepBa

    Score
    10/10
    remcosmercycollectionratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

    Defense Evasion

      Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Tasks