remcos | bf778ea445b149430eb6969bb6cb016bea268e5277bddbb4e0b2b96d14056400 | Triage

Sharing

General

Target

9cf363fbedce9ffb27df68141303d9e070185953
Size

396KB
Sample

230104-hzv72shf9y
MD5

ede54566379dc00e28e2330dc4d9e96b
SHA1

9cf363fbedce9ffb27df68141303d9e070185953
SHA256

bf778ea445b149430eb6969bb6cb016bea268e5277bddbb4e0b2b96d14056400
SHA512

fbb65b28eec14fb3dd8028e4226f2b7e5239fa77262797c8dd40e22770efb2f23f38cdd9b639c9b885043c2eb3534a3b6caed874722527bd2ece9c95dc1f07eb
SSDEEP

12288:GlUV1s9uxQ0djHuDsIhXMbkEODKiuLnL7ZJAdGyO+:2uPb+uL5J+RO+

Score

10^/10

remcos rat

Malware Config

Targets

- Target
  
  9cf363fbedce9ffb27df68141303d9e070185953
- Size
  
  396KB
- MD5
  
  ede54566379dc00e28e2330dc4d9e96b
- SHA1
  
  9cf363fbedce9ffb27df68141303d9e070185953
- SHA256
  
  bf778ea445b149430eb6969bb6cb016bea268e5277bddbb4e0b2b96d14056400
- SHA512
  
  fbb65b28eec14fb3dd8028e4226f2b7e5239fa77262797c8dd40e22770efb2f23f38cdd9b639c9b885043c2eb3534a3b6caed874722527bd2ece9c95dc1f07eb
- SSDEEP
  
  12288:GlUV1s9uxQ0djHuDsIhXMbkEODKiuLnL7ZJAdGyO+:2uPb+uL5J+RO+
Score

10^/10

remcos rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2