Overview

overview

10

Static

static

1

xas.ps1

windows7-x64

1

xas.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xas.ps1

  • Size

    5.0MB

  • Sample

    230328-rp47msdb6s

  • MD5

    f8aca613b0d32487540a483fd5f4d3b4

  • SHA1

    8f7492367b9b3f10b420401e91623435b45795ac

  • SHA256

    ef7534cbfb9701ec011fa5354837d6504aa36631e67ee7e328e33e2b751ba413

  • SHA512

    9009bdea9d4c1aa654ab5058e39f00884dc8d1769dd74bf30319d888411aca1a8c5a3f2c679d90072604153b537008a29dc9c13191b9626289f972327eb3a71a

  • SSDEEP

    49152:aY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+f:v

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

homoney177.duckdns.org:6703

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-95QDQQ

  • screenshot_crypt

    true

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    true

  • take_screenshot_time

    5

Targets

    • Target

      xas.ps1

    • Size

      5.0MB

    • MD5

      f8aca613b0d32487540a483fd5f4d3b4

    • SHA1

      8f7492367b9b3f10b420401e91623435b45795ac

    • SHA256

      ef7534cbfb9701ec011fa5354837d6504aa36631e67ee7e328e33e2b751ba413

    • SHA512

      9009bdea9d4c1aa654ab5058e39f00884dc8d1769dd74bf30319d888411aca1a8c5a3f2c679d90072604153b537008a29dc9c13191b9626289f972327eb3a71a

    • SSDEEP

      49152:aY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+f:v

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks