Overview

overview

10

Static

static

3

5000727fcb...34.exe

windows7-x64

10

5000727fcb...34.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5000727fcbed0dcfc21e8312c73d1334

  • Size

    1.2MB

  • Sample

    230919-ar5grafg78

  • MD5

    5000727fcbed0dcfc21e8312c73d1334

  • SHA1

    96c9e489d7bd95e7662ecaa728759fb5b897a023

  • SHA256

    4653586fe8c7c15b54973814cbbf53e5bb24a220bddae01700d3243c6ff8135d

  • SHA512

    029fd6586b5a127440ad0db417b83e787116fdc66f17cff1b7c253b47da7ee80f5752de10d2c9197b24b85f61dc7c55501c5ecd2c1b93cfa5890ad2e42ef460c

  • SSDEEP

    24576:5TbBv5rUwzS5s1Axb9S/xJBylBGa6mXcqIAXiAQFSDzo:zBZSZ8xJBlLAXiAVw

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Version

4.9.0 Light

Botnet

RemoteHost

C2

lightvsv.duckdns.org:41784

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ZGCF3P

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      5000727fcbed0dcfc21e8312c73d1334

    • Size

      1.2MB

    • MD5

      5000727fcbed0dcfc21e8312c73d1334

    • SHA1

      96c9e489d7bd95e7662ecaa728759fb5b897a023

    • SHA256

      4653586fe8c7c15b54973814cbbf53e5bb24a220bddae01700d3243c6ff8135d

    • SHA512

      029fd6586b5a127440ad0db417b83e787116fdc66f17cff1b7c253b47da7ee80f5752de10d2c9197b24b85f61dc7c55501c5ecd2c1b93cfa5890ad2e42ef460c

    • SSDEEP

      24576:5TbBv5rUwzS5s1Axb9S/xJBylBGa6mXcqIAXiAQFSDzo:zBZSZ8xJBlLAXiAVw

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks