Overview

overview

10

Static

static

3

AWB25637373283GT.exe

windows7-x64

3

AWB25637373283GT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AWB25637373283GT.iso

  • Size

    70KB

  • Sample

    230502-jyqfvaab93

  • MD5

    d6bce3df731ca623b99883a73a98fdcf

  • SHA1

    626529006824eec082edb560e1a5d9fb7514431e

  • SHA256

    897616b24bebbd22e1434c357b3c069889fa7c8d7e2ec1b679f7ee6bc2c270f4

  • SHA512

    0385bac9ed1619a3df55f279eeb64b3fb90abcf0af93446f3f9d4bb7db3dbc86b9ba54b6dc4200d79619d2930fd47f7e3e6c82e923a5b0173922a1f3024bdfb6

  • SSDEEP

    192:ulz683fmMbhjfON+D5LUELalfNXTRe5YqM0UP8mmILgmNfDTgP6F:05lYMLUELsfNXdPjngP6

Score
10/10
remcosremotehostcollectionpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

obologs.work.gd:34346

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-SI52AW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      AWB25637373283GT.exe

    • Size

      8KB

    • MD5

      765e838105b7c2f6937d93f94336400f

    • SHA1

      349cd40b0d346a164d68665a1a81f8233d482d81

    • SHA256

      e1e5649b11992bddafd4ca3b16396043eb4049b58c7500237fdd307a0d414102

    • SHA512

      57eac422db79f9efb53f95eeb928ed1ac9afa33fe4af58dcb6a6bcfbe6e920f089f477220f6e8a23bbbed36e8162ca1f9c4ed3cc6dc9e2444d4648f8297c53ce

    • SSDEEP

      192:KjfON+D5LUELalfNXTRe5YqM0UP8mmILgmNfDTgP6F:BMLUELsfNXdPjngP6

    Score
    10/10
    remcosremotehostcollectionpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks