Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3

  • Size

    571KB

  • Sample

    230605-h2sjyafh2v

  • MD5

    83e968ea79da03bc0e20716cd99d5fcb

  • SHA1

    43234878888b72b4d6e9b7704f5c7715edff72c2

  • SHA256

    6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3

  • SHA512

    0f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162

  • SSDEEP

    12288:PzyVo66yEEb3S797oaquKg0D9BLdlv+z2UtnhWf34kF:ubURl0DBlv+z1nYvZ

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

pekonomia.duckdns.org:30861

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-B0VP4N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3

    • Size

      571KB

    • MD5

      83e968ea79da03bc0e20716cd99d5fcb

    • SHA1

      43234878888b72b4d6e9b7704f5c7715edff72c2

    • SHA256

      6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3

    • SHA512

      0f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162

    • SSDEEP

      12288:PzyVo66yEEb3S797oaquKg0D9BLdlv+z2UtnhWf34kF:ubURl0DBlv+z1nYvZ

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks