Overview

overview

10

Static

static

1

'.exe

windows7-x64

3

'.exe

windows10-2004-x64

3

IMGES3.vbs

windows7-x64

8

IMGES3.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMGES3_Mia_kjhaleifa_JPG.zip

  • Size

    5.1MB

  • Sample

    240331-bs6xmsbc6w

  • MD5

    581a4cc015fecdacd0422dcd7d8cc650

  • SHA1

    52161de6e3abaff78de139e8d51c0c7fec58e1f8

  • SHA256

    d67ec67aea3e158c8a167d39329491e56e6fdeb5f52c941767624287d5cf6128

  • SHA512

    566273dd30fe098d9ab02b46f59e828d772b554170c55d1442c05bf73ac986e7ffb75fa356476e45d554bc9aada4095b587d322ca7b1ebcedc8853e185fb294b

  • SSDEEP

    98304:kIzNr9lPCdFseB0KxJFkaKxnyEKyUpm45yxw9gD00th3+TPP2/ccm:9hlKdGejJuyJwwmD00z+acF

Score
10/10
asyncratremcosxenoratauscadaaaa222newsssniceeeeeeeeeeeeeepersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

CAdaaaa222

C2

141.95.84.40:6262

Mutex

qw123123ecasdzcxqwe

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

remcos

Botnet

Newsss

C2

141.95.84.40:4090

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    awcvvwvvwa-MZS2PC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

remcos

Botnet

NICEEEEEEEEEEEEEE

C2

141.95.84.40:3939

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    acwaw2-S0GXDB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

xenorat

C2

141.95.84.40

Mutex

asasasasa_nd891332d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Extracted

Family

remcos

Botnet

AUS

C2

141.95.84.40:3636

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    asasasasasadtssrsar-SCM43H

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      '

    • Size

      5.1MB

    • MD5

      863fa58aa1fe8a88626625b191d4722e

    • SHA1

      e7fb4bf69be5ac4583c0c02e26a17bd3cdef4c02

    • SHA256

      45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220

    • SHA512

      ffd3bf831e8f0dc605706075a9763c68552f6560aa8660d7993e5156f64032fbc4ff6134fd333822e3090fb863cecff9e463316a8d9c3150152b73f8377aa2bd

    • SSDEEP

      98304:m73/fXBy7vaQfw2Tx9ygyzn00+IQFikLo7ANSDkatVVoj9dU5UywL:AHXk7yQpxy0LEAADkahowULL

    Score
    3/10
    behavioral1behavioral2

    • Target

      IMGES3.vbs

    • Size

      111KB

    • MD5

      1cd6415a95aade92977e47bfe9b630a6

    • SHA1

      db3b582e59371bd1bebdda59678ec39c68d928bb

    • SHA256

      84173441b7c16b960ee4e1532ae137955c12d0250696694405683a52e36920e6

    • SHA512

      31b6cd53e2bfd3b0ef935721ea4ce6b3c4674badfe00dd173a6fe54507a16f245d989dd6efd420f495e095f58dd0dfdec6d3da35cd2d197d6126a69fcd3f9bbd

    • SSDEEP

      1536:563LRV0ubIGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGPrbrbTDDpDFW:+VJVkhbAme

    Score
    10/10
    asyncratremcosxenoratauscadaaaa222newsssniceeeeeeeeeeeeeepersistencerattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks