Overview

overview

10

Static

static

1

TNT Origin...DF.exe

windows7-x64

3

TNT Origin...DF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    TNT Original Invoice PDF.ace

  • Size

    981KB

  • Sample

    230213-pk5aqscf2z

  • MD5

    1308064a3157ff309109c47b12268855

  • SHA1

    1dc919aef81ba511d63583b5f31f738f0865baa6

  • SHA256

    60ebf1b18422675b907c8f64e5b567d002326d2f011de975b037586fa93791cf

  • SHA512

    192c0715a7428e9f44f6c123d5c97aeb6fa90d7abf560d1a285a178325274bc59685cef521d72bca9b4e4662dc703f249673141cf22c5ccebbb86492076ccdc3

  • SSDEEP

    24576:vb4JIdEyRlDd+NnyKKPdoBI97F4W0mP/SrgacoplHMc4FESNRUfJ8mVs:vcwEudSyKkoBIJKJbTEPUB8os

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

51.75.209.245:2406

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-52YOYG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      TNT Original Invoice PDF.exe

    • Size

      1.1MB

    • MD5

      084b5737c3d11facc426695c38cd25b6

    • SHA1

      e914c85c45f3dd7d8a54bbf06526be8d99e37ac7

    • SHA256

      fe13c562eb51184678071a87b4a1383fd1103b867c45510895d9cc9a817b155b

    • SHA512

      355fffc16e633755822b289658733bae884365d1f08ec86d86c532f43705ef1246297847c50eee1aa89c035548943c5ec0708069a4ba23c8f8794f5e6beec8f9

    • SSDEEP

      24576:4blMRSWLxRh9hLb65hgFoIw2AsEsLOwd3DG1u+jCAWcU9GZd1U:4blMFLxHq8wvwhDGhWNw

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks