Overview

overview

10

Static

static

aa4ad373d2...3c.exe

windows7-x64

10

aa4ad373d2...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa4ad373d2e9b58a03f4e5526bfec18522c49f75f0980d0fce33469d88506b3c.exe

  • Size

    793KB

  • Sample

    221205-qc774aga4v

  • MD5

    523b250e53808bda95dd9397f84cc49d

  • SHA1

    896e17a0eb275044a20316d318adb88338b5efee

  • SHA256

    aa4ad373d2e9b58a03f4e5526bfec18522c49f75f0980d0fce33469d88506b3c

  • SHA512

    057302e33dde299ffed41408541058c5ef6ef0d1d288097d72f871b5a76a2fd850ede6a2583a7c7482af1b1a65267b3041d121dbcf1bb2c862e95e34f1c9f546

  • SSDEEP

    12288:AsjhiWL/rnUl+7CMPcpAN2B/TNl1Ltn7v2dW0haECl6:1hiWLDUlYCMQ/T71Ltn7v2sECg

Score
10/10
remcosmanuprat

Malware Config

Extracted

Family

remcos

Botnet

manup

C2

91.193.75.188:60005

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-Y6KFVO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      aa4ad373d2e9b58a03f4e5526bfec18522c49f75f0980d0fce33469d88506b3c.exe

    • Size

      793KB

    • MD5

      523b250e53808bda95dd9397f84cc49d

    • SHA1

      896e17a0eb275044a20316d318adb88338b5efee

    • SHA256

      aa4ad373d2e9b58a03f4e5526bfec18522c49f75f0980d0fce33469d88506b3c

    • SHA512

      057302e33dde299ffed41408541058c5ef6ef0d1d288097d72f871b5a76a2fd850ede6a2583a7c7482af1b1a65267b3041d121dbcf1bb2c862e95e34f1c9f546

    • SSDEEP

      12288:AsjhiWL/rnUl+7CMPcpAN2B/TNl1Ltn7v2dW0haECl6:1hiWLDUlYCMQ/T71Ltn7v2sECg

    Score
    10/10
    remcosmanuprat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks