remcos

General

Target

4da41093eb4cce80c18d1e6a2391ba80.exe
Size

500KB
Sample

230329-hxmswsgh2s
MD5

4da41093eb4cce80c18d1e6a2391ba80
SHA1

c6e1338fb7c3ffc9d39d5362722110e8482216ea
SHA256

f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
SHA512

43ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
SSDEEP

6144:+Ya6HI+QksRbJpnYqzFNZDPln6PJWJIFwYdga6c4jLvw1SxhDUoj+Xxk1Zci2E6e:+Y1I+QkunY8LzlOWi2HjHw1k15FqvK

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

SixthClients

C2

top.not2beabused01.xyz:1558

sub.not2beabused02.xyz:1558

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
appsync.exe
copy_folder
Appsync
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Appsync
keylog_path
%AppData%
mouse_option
false
mutex
Appsync-TYGH55
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Appsync
take_screenshot_option
true
take_screenshot_time
55
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;

Extracted

Family

warzonerat

C2

top.not2beabused01.xyz:1668

Targets

- Target
  
  4da41093eb4cce80c18d1e6a2391ba80.exe
- Size
  
  500KB
- MD5
  
  4da41093eb4cce80c18d1e6a2391ba80
- SHA1
  
  c6e1338fb7c3ffc9d39d5362722110e8482216ea
- SHA256
  
  f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
- SHA512
  
  43ea46aeeda700e7b7e1f1f3fdede845e8d5723204d854e5452f9af785a20a9a915e1d9e4f44162777f2e5f569eda06904548114667ae05a285a980cb426dcd3
- SSDEEP
  
  6144:+Ya6HI+QksRbJpnYqzFNZDPln6PJWJIFwYdga6c4jLvw1SxhDUoj+Xxk1Zci2E6e:+Y1I+QkunY8LzlOWi2HjHw1k15FqvK
Score

10^/10

remcos warzonerat sixthclients collection infostealer persistence rat spyware stealer
- Modifies WinLogon for persistence
  persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Warzone RAT payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2