Overview

overview

10

Static

static

1

PO98654356...00.jar

windows7-x64

10

PO98654356...00.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO98654356789999000.jar

  • Size

    2.2MB

  • Sample

    231213-psby6acffm

  • MD5

    849ffec0b81a28b95e18a0ee5ebf34f8

  • SHA1

    7b0cd2c9de0969ae8f17531bd3e2f73eb1a4df46

  • SHA256

    502a4b4a5c731a429d87dad2391e78f2bb6464c9fccc4fbc36d85ed8849b3879

  • SHA512

    83d0a46ceef218585d5fbfa76180d9424c66b2c121e1343fd971f659a024a5b1b1080d6e5d87024c33a4730cebe649b7323902a3d3112817f54d60b8ba843382

  • SSDEEP

    49152:L8jmzqWFy1Xt6wzmUiwVksjmzqWFy1Xt6wzmUiwVkp:oW0Xt6wW8W0Xt6wWp

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      PO98654356789999000.jar

    • Size

      2.2MB

    • MD5

      849ffec0b81a28b95e18a0ee5ebf34f8

    • SHA1

      7b0cd2c9de0969ae8f17531bd3e2f73eb1a4df46

    • SHA256

      502a4b4a5c731a429d87dad2391e78f2bb6464c9fccc4fbc36d85ed8849b3879

    • SHA512

      83d0a46ceef218585d5fbfa76180d9424c66b2c121e1343fd971f659a024a5b1b1080d6e5d87024c33a4730cebe649b7323902a3d3112817f54d60b8ba843382

    • SSDEEP

      49152:L8jmzqWFy1Xt6wzmUiwVksjmzqWFy1Xt6wzmUiwVkp:oW0Xt6wW8W0Xt6wWp

    Score
    10/10
    remcosremotehostratdiscovery

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks