Overview

overview

10

Static

static

1

tloader (1).exe

windows7-x64

10

tloader (1).exe

windows10-2004-x64

10

Resubmissions

10-10-2023 23:09

231010-25ft4aah69 10

26-03-2023 02:21

230326-cs245ahc2t 10

19-01-2023 16:02

230119-tgvpcage62 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tloader (1).exe

  • Size

    1.5MB

  • Sample

    230326-cs245ahc2t

  • MD5

    839e1f8705362603a1dcbb5adfe6d6e1

  • SHA1

    9a96746b27945440c362402b161daac34ce00a84

  • SHA256

    0ca246e6325bfa1bd4aa4f743a259d4c3553a316a44665a5a21d5d5132b893c0

  • SHA512

    1e1a294c21f22f8c1b1ed94cd30a3316f4dee2371ad3dc9b1dd1026955b87fdbd34b6295322a653b9fe6e6f3283b3f7bb5fe56c942e51d0a2b0983f8adda42e5

  • SSDEEP

    24576:/pBtKkpXwKPHp0EVWnqMKMklXZ8N7Y5jQoLOnrq/aCVXcA9:9TdvMKMklXSN7YDOrqyCVXv9

Score
10/10
remcosthorami-v5rat

Malware Config

Extracted

Family

remcos

Botnet

thorami-v5

C2

rlbotz.duckdns.org:2404

80.76.51.46:2404
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    update.exe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    furog.dat

  • keylog_flag

    false

  • mouse_option

    false

  • mutex

    Rvhugures-AM08A0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    nupdat

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      tloader (1).exe

    • Size

      1.5MB

    • MD5

      839e1f8705362603a1dcbb5adfe6d6e1

    • SHA1

      9a96746b27945440c362402b161daac34ce00a84

    • SHA256

      0ca246e6325bfa1bd4aa4f743a259d4c3553a316a44665a5a21d5d5132b893c0

    • SHA512

      1e1a294c21f22f8c1b1ed94cd30a3316f4dee2371ad3dc9b1dd1026955b87fdbd34b6295322a653b9fe6e6f3283b3f7bb5fe56c942e51d0a2b0983f8adda42e5

    • SSDEEP

      24576:/pBtKkpXwKPHp0EVWnqMKMklXZ8N7Y5jQoLOnrq/aCVXcA9:9TdvMKMklXSN7YDOrqyCVXv9

    Score
    10/10
    remcosthorami-v5rat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks