Overview

overview

10

Static

static

3

KOPA23112030-01.exe

windows7-x64

10

KOPA23112030-01.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    13112023_2131_13112023_KOPA23112030-01.rar

  • Size

    1.3MB

  • Sample

    231113-qscq5adc83

  • MD5

    893449412367c2b587c67e5cfb0fa875

  • SHA1

    67c1141f6621e5e37f70d08955e506c0503f0829

  • SHA256

    bba6e6db245666b472775c1b9c5850980838afe2ee6ab3dcf51d59b40fc42f85

  • SHA512

    7fb4afcd1ee03389c5b48db331f1ecd032e5d0f09982eeb380c06852e491fc5784ece5aa5badd9ba6e80f09678a8b18d23dbeecd66242acb0761c2ec7d9dfcd5

  • SSDEEP

    24576:t2jaMZT1mFOOZ9FiiJRNGbgIoqsTRy4ZoAhI03TYgim+eG/NWpv3X5ySwCV:t2jL7DUnA5ARy4XhIyYgCOfX5y2

Score
10/10
remcosremotehostcollectionratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.93.187.227:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-1H7LNN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      KOPA23112030-01.exe

    • Size

      1.3MB

    • MD5

      d1ef4e1cae5371c05ad9e428ac4d193c

    • SHA1

      eaa675a53e9278afab0930178183adea8e0c5b59

    • SHA256

      c4bc36c6384546241dedc69f4f001bf81d094446023b4f306af205462eae12e9

    • SHA512

      f10f0ebf63d9d19ae19d85f7e67153eccc98cdf451d28a2f32db9ee77e3f3382391fe52a58f4eb616ad650c0c2ab5ad5e3ca8805fbf33f7bfe5c738f3a346360

    • SSDEEP

      24576:E/0OjrhVBbvCQE0rDWBDV8zRemPRtHUNubGF6Xg7Rmj26V6bw6aZWn:E/n1VNa0nWdMkm/HiuY7o26A06aS

    Score
    10/10
    remcosremotehostcollectionratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks