Overview

overview

10

Static

static

3

4363463463...63.exe

windows10-2004-x64

10

Resubmissions

11/02/2024, 08:10

240211-j212ragb4710

11/02/2024, 08:09

240211-j2kprseb2w10

09/02/2024, 18:28

240209-w4c4xsde9t10

02/02/2024, 12:52

240202-p4dxwsgfej10

02/02/2024, 12:45

240202-pzapnsgdbp10

16/01/2024, 15:29

240116-sw8dbaehh310

10/01/2024, 14:41

240110-r2wq2ahchl10

10/01/2024, 13:29

240110-qrqatshbg310

22/12/2023, 08:48

231222-kqp1sadghq10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4363463463464363463463463.bin.zip
  • Size 4KB
  • Sample240211-j2kprseb2w
  • SHA256 0c951f58a23cd2c9bdccb727d41e33e740344af36d91419907ce016977b2a62d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
remcosvidarzgrat1827go!!!ratstealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://houssagynecologue.com/assets/js/debug2.ps1

Extracted

Family

  • vidar

Version

  • 55.7

Botnet

  • 1827

C2

  • https://t.me/deadftx

  • https://www.ultimate-guitar.com/u/smbfupkuhrgc1

  • http://116.202.2.1:80

Attributes
  • profile_id

    1827

Extracted

Family

  • remcos

Botnet

  • Go!!!

C2

  • dangerous.hopto.org:2404

  • dangerous.hopto.org:2602

  • 91.92.242.184:2602

  • 91.92.242.184:2404

Attributes
  • audio_folder

    ??????????? ??????

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    taskhost.exe

  • copy_folder

    System32

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    tapiui.dat

  • keylog_flag

    false

  • keylog_folder

    System32

  • mouse_option

    false

  • mutex

    ???-LDKG91

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    ?????????

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target
      4363463463464363463463463.bin
    • Size 10KB
    • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    remcosvidarzgrat1827go!!!ratstealer

    • Detect ZGRat V1

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks