General

  • Target

    5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.zip

  • Size

    886KB

  • Sample

    240402-lz664ade8y

  • MD5

    65b1e83966033f64f02f566b24761ab9

  • SHA1

    a79cdc00bfc06e1fed94223f54325513fb937752

  • SHA256

    c82b6fc08bcfa1d30118384b13965df8a3136f5143680a25f7c49abefd260f24

  • SHA512

    4e993caa49f72c072bae609222d762d4141d39668d97578496ee9d7a68bdba833358664f3ade6411589c39371cd711f8f37870e51fd5783eff99d9a3e51e7a6f

  • SSDEEP

    24576:btokp5y7CFEj883pU1MDJnuRFCQvZxJr+AKpSY:5okp54kEj8KbDJnuHCQhxJyl

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

194.147.140.180:1987

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-FRNTO2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.exe

    • Size

      998KB

    • MD5

      9a942028f55f59560c38677923c7ce6a

    • SHA1

      069cf2b7306f61ac65a4598f519a83dd535325c9

    • SHA256

      5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb

    • SHA512

      e3f0f2d9d97cfa7178d3fd1e12cd35c9b1a5b08e92767389bcf998e428e08e4527fa7b9204941e849a6f28c240c52c57b653777e7620210c5d024dbce0a22eda

    • SSDEEP

      24576:yxWTl+NDnZjbBxcxyGFKjL8kFzzjBh3HrYMY:lpknZHEyGw3t3cz

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks