General

  • Target

    0987654000090000.BAT.exe

  • Size

    463KB

  • Sample

    231212-ngjzyscafn

  • MD5

    ac851f5b083c90453be2536fb7cf8eb0

  • SHA1

    65832ec449c430855a54607908d71d58896293ff

  • SHA256

    ac9790802a041c8d44f6bd430e0cc97ab9f452445aca1706acfe05851f7ce8a3

  • SHA512

    9914deaae2c36d9b61da41bcd7cc2152083b715c48423df9625183a829e61d244ba67794776ab2669975189fe28b5da65dde1d24f230613be784307767ff3fa6

  • SSDEEP

    6144:M8LxBwEVDPYW8JlHZB97/vh9122pfz0ryHoAtk9t/xiXT1yFahtXBpve5CzmTc/G:8uY3jZX7r12ZryIAtkvWpOstuCzJTHi

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      0987654000090000.BAT.exe

    • Size

      463KB

    • MD5

      ac851f5b083c90453be2536fb7cf8eb0

    • SHA1

      65832ec449c430855a54607908d71d58896293ff

    • SHA256

      ac9790802a041c8d44f6bd430e0cc97ab9f452445aca1706acfe05851f7ce8a3

    • SHA512

      9914deaae2c36d9b61da41bcd7cc2152083b715c48423df9625183a829e61d244ba67794776ab2669975189fe28b5da65dde1d24f230613be784307767ff3fa6

    • SSDEEP

      6144:M8LxBwEVDPYW8JlHZB97/vh9122pfz0ryHoAtk9t/xiXT1yFahtXBpve5CzmTc/G:8uY3jZX7r12ZryIAtkvWpOstuCzJTHi

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks