Overview

overview

10

Static

static

1

7e3c88ffb4...20.exe

windows7-x64

10

7e3c88ffb4...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7e3c88ffb4823221b26974cf88c27020.zip

  • Size

    1.6MB

  • Sample

    230418-bt7kkaha78

  • MD5

    346eb4239b7dee9a413b685ef798c2fb

  • SHA1

    33350be613e397cc0c6d69fb8232769e9fb7cc44

  • SHA256

    8e65693b95ab10143d3e363c51097949932e4e6ffb840dcf9094c694d878a92d

  • SHA512

    0a1e0c6ed4f1011a06c5e9f16f5054d216cc88488b6d5995180091575c17b54454cbd7484541480c789fbaf3700c1004adb9378753165db74b399c271b714957

  • SSDEEP

    24576:OwV+jWugVTF/1VuijQXuEA4drCdsnfp/+:LQsJxjQXhA4dkqfp/+

Score
10/10
remcosricosrat

Malware Config

Extracted

Family

remcos

Botnet

RICOS

C2

svjhfviuerfvnojdsnvo.con-ip.com:1883

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-FIH4KJ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      7e3c88ffb4823221b26974cf88c27020

    • Size

      1024.0MB

    • MD5

      a6dd9e0d127491391cfa9a58196321ac

    • SHA1

      9c092ca45847074fca1bd4058ee9c64eb4408196

    • SHA256

      524a0f26b07636670c06f62798e2d9c697ea8b6ce335631b0252aa2f88f4fb86

    • SHA512

      29f4ad61137155742f9abd77d7655925196bff281e5e0e64a0a5c7dd8fb8df163fcc6ba392977c8216c5380b354985c006a50a67e79564e7379aad99a1d1a1ae

    • SSDEEP

      12288:UUM85dV9KrSRNouYVT9L94SpnyKuijGXwPGXS4nrEwosKtYaP:Pf9KQSVT97pruijGXuGi4nrE9sdaP

    Score
    10/10
    remcosricosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks