Overview

overview

10

Static

static

3

Item_list0025.exe

windows7-x64

10

Item_list0025.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Item_list0025.zip

  • Size

    847KB

  • Sample

    240125-jsxyqscbbm

  • MD5

    7f044f94304424d92b90ee25aab6e8e2

  • SHA1

    b31f2268d09cb9efed6273abf916041a8fc41053

  • SHA256

    f1264487fba4a81c89589b909366c9a8f1c17cb3d5703aad256cf3917201a17e

  • SHA512

    fef046716940dca3541c2a4a6a65207b85b7e81970f11d52dcef65b5d2060ff63e0c3daf73e563021e1373ac343d429a22b47e2b1e536ea3ec75a0dbe9a2b8e8

  • SSDEEP

    24576:bMxSOWyRILTWsha9RyGtftA5A0duAYLyz8h:boQOIja/ArxAh

Score
10/10
remcosdkcollectionratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

dk

C2

64.188.20.186:5050

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TPXVZV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Item_list0025.exe

    • Size

      862KB

    • MD5

      8c0808705c8abff0a07a6ca91c6df24e

    • SHA1

      28aaae99c9b7290252d7f4bb8fd7e50e9942345c

    • SHA256

      8957582ccd1876780ff5a43336984ee23ff03be1c8184a6ff9797828f52536e1

    • SHA512

      1ff6598349a3d82f7160dcf3dc7189a85872ce5b47ac8bacd74bbfc166668573b2b923fabf07059dbc0bc8b5cf956993355219bcae26169440c5c8283217deac

    • SSDEEP

      24576:mJci+WaRI9bCsla3fAqdfXu5IIhxiwe7:KmI9afu+Iff

    Score
    10/10
    remcosdkcollectionratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks