Overview

overview

10

Static

static

1

Scan76530.exe

windows7-x64

10

Scan76530.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    340c8d17ee1d0888f89d445e1462ce01

  • Size

    315KB

  • Sample

    230314-kdghwagd7s

  • MD5

    340c8d17ee1d0888f89d445e1462ce01

  • SHA1

    c998cfde40ea59ad85d9f4c27c73d51f1bd4fe91

  • SHA256

    62ef0d16d35193c0fe1db5e3546594fef9b6a4362ecd87c040df9ab1e767bbd1

  • SHA512

    5dfc7bd69d72c6fad72364a7dc623f5969a35482fea16c057a70bed0a30ab862c4b57ab2c0abf401a1e3ee9e8c97bd454cda097f48b583b10df52697c15ee178

  • SSDEEP

    6144:CdLy03GgFY5FTCB9mL/8vo0abevx0OniJNw2wMROuxBzy7BOv1p3kMxB:CV33GgF1B9Wc0OnQwMdMBO9VkMH

Score
10/10
modiloaderremcosbishop bishoppersistencerattrojan

Malware Config

Extracted

Family

remcos

Botnet

BISHOP BISHOP

C2

bishoprem.duckdns.org:1336

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-3MSK98

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Scan76530.exe

    • Size

      769KB

    • MD5

      4f3e44e31671b7fa0fae0a6cae1c1a04

    • SHA1

      34d5d70128fd454fd936b2cc40f04f793d9e8087

    • SHA256

      5491b9bc04760d9dfbdc3a96941f4672f740c22c60029abd0a8f64cf73036819

    • SHA512

      09cb39025a18f0cf73e98fdd7648a2ee1c79d02d264ecb3fb0c44523d0ba3395bc18ef16eb2a468764ae5623f1b2dacf8c6ef4bae0d07ba4bd996f040de8f673

    • SSDEEP

      12288:gKLJyUZiUWf0sSEpcwXybqAsespUI2ARl/NnLLm:fly1UWf0s7qwXwI1pUD2l/NnLL

    Score
    10/10
    modiloadertrojanremcosbishop bishoppersistencerat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks