Overview

overview

10

Static

static

3

cad377f243...8a.exe

windows7-x64

10

cad377f243...8a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cad377f243b54e3dddfe149f4cd54c8a.exe.bin

  • Size

    925KB

  • Sample

    230511-xa54aahg43

  • MD5

    cad377f243b54e3dddfe149f4cd54c8a

  • SHA1

    bb9e4fc981c04378758051885dc6e5062145b11b

  • SHA256

    14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a

  • SHA512

    8937d17ec7b4305632bfb6f090baab30ff263a01e77877b4caf205a4100ddb3743632a6206f0c770c1896357121903228a14235d4f5cbee0a08a8fe6606a302d

  • SSDEEP

    24576:PdWUwhh26ZKwupWOZBSV/UXsiff0dFB0cK74aRlLMGZYWkV3M:PdWXKwIrZsVc8isK74aPM5F

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

seanblacin.sytes.net:6110

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    chrcrh.exe

  • copy_folder

    chrcrh

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    chrcrh

  • mouse_option

    false

  • mutex

    Rmc-FDI6XX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    chrcrh

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      cad377f243b54e3dddfe149f4cd54c8a.exe.bin

    • Size

      925KB

    • MD5

      cad377f243b54e3dddfe149f4cd54c8a

    • SHA1

      bb9e4fc981c04378758051885dc6e5062145b11b

    • SHA256

      14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a

    • SHA512

      8937d17ec7b4305632bfb6f090baab30ff263a01e77877b4caf205a4100ddb3743632a6206f0c770c1896357121903228a14235d4f5cbee0a08a8fe6606a302d

    • SSDEEP

      24576:PdWUwhh26ZKwupWOZBSV/UXsiff0dFB0cK74aRlLMGZYWkV3M:PdWXKwIrZsVc8isK74aPM5F

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks