Overview

overview

10

Static

static

1

BTSR000166442.vbs

windows7-x64

10

BTSR000166442.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BTSR000166442.vbs

  • Size

    72KB

  • Sample

    231026-htsvqsec26

  • MD5

    91192904788702d6692ef01f9a6d8989

  • SHA1

    14f1f98a04b6eb9c3d22a522dc72cbf3221d00d6

  • SHA256

    b632a2ab492dbe0f71c18cab99b61bded82cbb66696f2d30c9bc354605ebb136

  • SHA512

    54f1bca79c4265c85c9a4d72426a7b97c52585674bf910294628b1c7ca979b5cfd538c42a665d06b768c603e720f7019d583d44e06802adb64b24c82a3bda345

  • SSDEEP

    1536:fabO/mdBAdZ1tuJErgT2nOCzFx7zDiPWBvkkhO:Sbi2A31tAT2n1Fx3DOWBvkkhO

Score
10/10
guloaderremcosremotehostdownloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

a458386d9.duckdns.org:3256

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-42EOAE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      BTSR000166442.vbs

    • Size

      72KB

    • MD5

      91192904788702d6692ef01f9a6d8989

    • SHA1

      14f1f98a04b6eb9c3d22a522dc72cbf3221d00d6

    • SHA256

      b632a2ab492dbe0f71c18cab99b61bded82cbb66696f2d30c9bc354605ebb136

    • SHA512

      54f1bca79c4265c85c9a4d72426a7b97c52585674bf910294628b1c7ca979b5cfd538c42a665d06b768c603e720f7019d583d44e06802adb64b24c82a3bda345

    • SSDEEP

      1536:fabO/mdBAdZ1tuJErgT2nOCzFx7zDiPWBvkkhO:Sbi2A31tAT2n1Fx3DOWBvkkhO

    Score
    10/10
    guloaderdownloaderpersistenceremcosremotehostrat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks